Description

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder credentials-package extraction workflow does not verify that each archive member remains within the intended destination before extraction. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Configure forwarders to send SOAR data to your Splunk deployment (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/configure-administration-settings-in-splunk-soar-on-premises/configure-forwarders-to-send-soar-data-to-your-splunk-deployment) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T22:17:21.130Z",
  "pubdate": "2026-08-19T22:17:21.130Z",
  "executiveSummary": "A path traversal vulnerability exists within Splunk SOAR versions below 8.6.0. The flaw resides in the Universal Forwarder installer's archive extraction mechanism, specifically within the credentials-package extraction workflow. An authenticated user holding the Administrator role can exploit this vulnerability to achieve arbitrary file write operations outside the intended installation directory. The primary risk implication involves unauthorized modification of the underlying filesystem, potentially leading to system compromise or privilege escalation depending on the files overwritten. Exploitation requires administrative privileges within the application and involves supplying a specially crafted archive containing path traversal sequences (such as dot-dot-slash notation) that the extraction routine fails to validate against the intended destination directory.",
  "technicalDetails": "The root cause of the vulnerability is the lack of proper validation checks on archive members during the Universal Forwarder credentials-package extraction workflow in Splunk SOAR versions below 8.6.0. Specifically, the vulnerable component processes compressed archive payloads without verifying that each extracted member remains strictly contained within the intended installation directory boundary.\nExploitation requires authentication and the Administrator role. The attack flow proceeds as follows: 1. An attacker with administrative privileges initiates the Universal Forwarder configuration or credentials-package upload workflow within Splunk SOAR. 2. The attacker supplies a maliciously crafted archive file where filenames or archive member headers contain path traversal sequences (e.g., ../). 3. The vulnerable extraction function parses the archive without validating the target paths against the root destination directory. 4. Consequently, the application writes the payload files to arbitrary locations on the filesystem outside the intended installation path, determined by the directory traversal sequences embedded within the archive headers.\nThe post-exploitation impact includes the ability to overwrite critical system or application files, potentially achieving arbitrary code execution or compromising the integrity of the host running Splunk SOAR."
}