CVE-2026-20297
HIGH 7.2In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24, a user who holds a role that contains the `edit_local_apps` and `install_apps` capabilities could cause a legitimate app installation to write files outside the intended app directory, into `$SPLUNK_HOME/etc/` and its subdirectories.<br><br>The vulnerability is caused by a path traversal in the app installation workflow, which does not restrict the installation path to the intended app directory.
Severe if exploited (CVSS 7.2), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.5%chance of exploitation in 30 days · 40th percentile
Impact if exploited
7.2CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires an admin / high-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
- github-search Search GitHub for public PoC repos
Test against your own equipment
curl -s https://vulnpedia.com/cve/CVE-2026-20297/poc.jsonMachine-readable PoC index for this CVE (for automation).Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-20297/poc.json
Weakness (CWE)
- CWE-22: The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Splunk | Splunk | ≥ 9.3.0 and < 9.3.14 |
| Splunk | Splunk | ≥ 9.4.0 and < 9.4.13 |
| Splunk | Splunk | ≥ 10.0.0 and < 10.0.8 |
| Splunk | Splunk | ≥ 10.2.0 and < 10.2.5 |
| Splunk | Splunk | 10.4.0 |
| Splunk | Splunk Cloud Platform | ≥ 10.1.2507 and < 10.1.2507.24 |
| Splunk | Splunk Cloud Platform | ≥ 10.2.2510 and < 10.2.2510.18 |
| Splunk | Splunk Cloud Platform | ≥ 10.4.2604 and < 10.4.2604.6 |
All CVSS metrics
- HIGH 7.2 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - HIGH 7.2 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H