CVE-2026-20297: Splunk Enterprise Path Traversal Flaw

CVE-2026-20297 Overview

CVE-2026-20297 is a path traversal vulnerability [CWE-22] in the Splunk Enterprise and Splunk Cloud Platform app installation workflow. A user holding a role with the edit_local_apps and install_apps capabilities can cause a legitimate app installation to write files outside the intended app directory. The write operation targets $SPLUNK_HOME/etc/ and its subdirectories. The flaw exists because the installation logic does not restrict the destination path to the intended app directory.

Critical Impact
An authenticated high-privilege user can write arbitrary files into Splunk configuration directories, enabling tampering with server configuration, apps, and potentially achieving code execution within the Splunk process context.

Affected Products

Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14
Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24
Deployments where users are granted edit_local_apps and install_apps capabilities

Discovery Timeline

2026-07-15 - CVE-2026-20297 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-20297

Vulnerability Analysis

The vulnerability resides in Splunk's app installation workflow. When a user with sufficient capabilities installs an app, the workflow processes the app package and writes files to disk. The workflow fails to validate or normalize file paths inside the app package against the target app directory. Attackers can embed traversal sequences in packaged file paths to escape the intended installation directory. Files land in $SPLUNK_HOME/etc/ or arbitrary subdirectories under it.

Writing into $SPLUNK_HOME/etc/ is impactful because that directory holds Splunk configuration files, apps, users, and system settings. An attacker can overwrite configuration files or plant malicious app content. This enables persistence, privilege escalation within Splunk, or execution of scripted inputs and alert actions.

Root Cause

The root cause is missing path canonicalization and containment in the app installation code. The installer treats file paths from the app archive as trusted. It does not reject entries containing .. traversal segments or absolute paths. This maps directly to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires network access to the Splunk management interface and an authenticated account with both edit_local_apps and install_apps capabilities. The attacker crafts an app package containing entries with directory traversal sequences in their file paths. Uploading and installing the crafted app triggers the write of those files to attacker-chosen locations under $SPLUNK_HOME/etc/.

// No verified public exploit code is available.
// See the Splunk Security Advisory SVD-2026-0703 for vendor technical details.

Detection Methods for CVE-2026-20297

Indicators of Compromise

Unexpected files or configuration changes appearing under $SPLUNK_HOME/etc/ outside of standard app subdirectories
App installation events in _audit logs from users holding edit_local_apps and install_apps roles that correlate with new files outside $SPLUNK_HOME/etc/apps/<appname>/
Newly created or modified inputs.conf, outputs.conf, server.conf, or authentication.conf files without a corresponding change control record
App package uploads containing archive entries with .. sequences or absolute paths

Detection Strategies

Monitor Splunk internal audit logs (index=_audit action=install) for app installations and correlate with filesystem modification events
Inspect uploaded .spl and .tar.gz app archives for entries whose normalized paths escape the archive root
Alert on writes to sensitive Splunk configuration files performed by the splunkd process outside of upgrade windows

Monitoring Recommendations

Enable file integrity monitoring on $SPLUNK_HOME/etc/ and all subdirectories
Review role assignments to identify accounts with combined edit_local_apps and install_apps capabilities and audit their activity
Forward Splunk internal indexes (_audit, _internal) to a centralized SIEM for cross-correlation with host telemetry

How to Mitigate CVE-2026-20297

Immediate Actions Required

Upgrade Splunk Enterprise to 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14, or later fixed release
Confirm Splunk Cloud Platform instances are running 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, 10.1.2507.24, or later
Audit and reduce the number of users granted the edit_local_apps and install_apps capabilities
Review recent app installations for unexpected files written outside $SPLUNK_HOME/etc/apps/<appname>/

Patch Information

Splunk released fixed versions addressing the path traversal in the app installation workflow. Refer to the Splunk Security Advisory SVD-2026-0703 for full remediation guidance and version details.

Workarounds

Remove edit_local_apps and install_apps capabilities from non-administrative roles
Restrict access to the Splunk management port (default 8089) to trusted administrative networks only
Require manual review of app packages by an administrator before installation in production environments

bash

# Verify installed Splunk version
$SPLUNK_HOME/bin/splunk version

# List roles that hold the vulnerable capability combination
$SPLUNK_HOME/bin/splunk list role -auth admin:<password> \
  | grep -E "edit_local_apps|install_apps"