CVEFinder.io

CVE-2026-20297

⚠️ high
🔍 Scan for this CVE
Summary

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow

Description

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.

CVSS Score
7.2
High
EPSS Score
0.5
Exploit Probability
Published Date
2026-07-15
First Seen: 2026-07-16
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 55.3% of all 338,292 vulnerabilities in our database.

#151,238
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 15, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Vinay Manivel, Splunk
SSVC data provided by CISA
Last Modified 2026-07-24
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE IDs (Weakness Types)
CWE-22

📦 Affected Products 8

Vendor Product Status Affected Versions
splunk splunk Affected
> 10.0.0 < 10.0.8
splunk splunk Affected
> 10.2.0 < 10.2.5
splunk splunk Affected
> 9.3.0 < 9.3.14
splunk splunk Affected
> 9.4.0 < 9.4.13
splunk splunk Affected
v10.4.0
splunk splunk_cloud_platform Affected
> 10.1.2507 < 10.1.2507.24
splunk splunk_cloud_platform Affected
> 10.2.2510 < 10.2.2510.18
splunk splunk_cloud_platform Affected
> 10.4.2604 < 10.4.2604.6

🔗 References 1

https://advisory.splunk.com/advisories/SVD-2026-0703
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-20296 ⚠️ high 8.3 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26... 2026-07-15
CVE-2026-20298 🔶 medium 5.3 0.2 In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.26... 2026-07-15
CVE-2026-20251 ⚠️ high 8.8 0.6 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.1... 2026-06-10
CVE-2026-20252 ⚠️ high 7.6 0.3 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.26... 2026-06-10
CVE-2026-20253 ⛔ critical 9.8 96.2 In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or tr... 2026-06-10
CVE-2026-20254 🔶 medium 5.7 0.3 In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.25... 2026-06-10
These CVEs affect the same products