CVE-2026-20297: Splunk Enterprise path traversal in App Install REST endpoint

CVE-2026-20297 · Severity: high · CVSS 7.2 · Published 2026-07-15

Splunk Enterprise and Splunk Cloud Platform are data analysis platforms used for monitoring and searching large datasets. A security flaw in the application installation process allows high-privileged users to write files to unauthorized locations on the server. This could lead to a full system compromise, data loss, or service disruption by overwriting critical configuration files.

Technologies: Splunk Cloud Platform. Vendors: Splunk.

Quick answers

Is CVE-2026-20297 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20297 being exploited in the wild.
How severe is CVE-2026-20297?
High severity, with a CVSS score of 7.2, published 15 July 2026.
Which products and versions are affected?
Splunk Cloud Platform < 10.5.2605.0, < 10.4.2604.6, < 10.2.2510.18, < 10.1.2507.24.
Is there a fix for CVE-2026-20297?
A patch was published on 2026-07-15: Fixes released in multiple Splunk Enterprise and Cloud versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20297 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-20297?
Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the App Install REST endpoint of Splunk Enterprise and Splunk Cloud Platform. The flaw is located in the 'explicit_appname' parameter within the app installation workflow, which fails to properly restrict the installation path. An attacker with a role containing 'edit_local_apps' and 'install_apps' capabilities can exploit this to write files into the '$SPLUNK_HOME/etc/' directory and its subdirectories. This could allow for the overwriting of sensitive configuration files or the introduction of malicious scripts. The issue is resolved in Splunk Enterprise versions 10.4.1, 10.2.5, 10.0.8, 9.4.13, 9.3.14, and corresponding Splunk Cloud Platform updates.

Affected products

  • Splunk Splunk Enterprise < 10.4.1, < 10.2.5, < 10.0.8, < 9.4.13, < 9.3.14
  • Splunk Splunk Cloud Platform < 10.5.2605.0, < 10.4.2604.6, < 10.2.2510.18, < 10.1.2507.24

Timeline

  • 2026-07-15: advisory: Initial disclosure by Splunk and NVD publication.
  • 2026-07-15: patched: Fixes released in multiple Splunk Enterprise and Cloud versions.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.