Description

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file paths stay within the intended destination directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:21.000Z",
  "pubdate": "2026-08-19T22:17:21.000Z",
  "executiveSummary": "An unvalidated archive extraction vulnerability exists in Splunk SOAR versions below 8.6.0, specifically within the app installation routine. This path traversal flaw allows an authenticated user with elevated app-install privileges to manipulate file paths during the extraction of application archives, enabling the writing of files outside the intended temporary directory.\nThe impact of successful exploitation includes arbitrary file write capabilities on the host system, which can compromise the integrity and security of the underlying infrastructure. The vulnerability requires a malicious actor to possess specific administrative privileges—namely app-install capabilities—and the ability to supply a crafted archive file to the system.\nWhile authentication and specific role-based permissions are prerequisites, the risk implication is severe due to the potential for attackers to overwrite critical system files or place executable payloads within sensitive directories. Organizations utilizing affected versions of Splunk SOAR face significant operational risk if an administrative account is compromised or abused.",
  "technicalDetails": "The vulnerability resides in the archive extraction routine utilized during the installation process of applications within Splunk SOAR versions below 8.6.0. The root cause of the issue is the failure of the application extraction logic to properly sanitize and validate file paths contained within archive headers. Specifically, the extraction routine lacks checks to ensure that resolved destination paths for individual files remain strictly within the intended temporary destination directory.\nThe exploitation method relies on directory traversal sequences, such as dot-dot-slash (../) patterns embedded within the filenames or paths inside a maliciously crafted application archive (e.g., .tar, .tar.gz, or .zip). When a user with the requisite privileges initiates the installation of this manipulated app package, the extraction routine blindly trusts the paths provided within the archive structure.\nThe attack flow proceeds as follows: First, an attacker authenticates to Splunk SOAR with a user account possessing app-install privileges. Second, the attacker uploads the crafted malicious archive through the standard application installation interface. Third, the backend extraction routine processes the archive and parses the unvalidated file paths. Fourth, the path traversal sequences force the file writing mechanism to traverse upward in the directory tree, allowing files to be written to arbitrary locations outside the designated temporary sandbox.\nThe vulnerable component is the archive processing and extraction subsystem handling external app packages. Privilege requirements necessitate an authenticated user with explicit app-install permissions. The post-exploitation impact is contingent upon where the files are written, potentially leading to unauthorized modification of system configurations, binary replacement, or the staging of malicious scripts for subsequent execution."
}