Description

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-19T22:17:22.607Z",
  "pubdate": "2026-08-19T22:17:22.607Z",
  "executiveSummary": "An arbitrary file write vulnerability exists in Splunk SOAR versions below 8.6.0 within the Automation Broker log upload functionality. The flaw enables authenticated users holding the OnPrem Broker role to bypass intended directory restrictions and write files to arbitrary locations outside the designated Automation Broker log directory.\nThe root cause stems from the application accepting crafted filename input during log upload operations without sufficient input sanitization or path traversal validation. Successfully exploiting this vulnerability allows an attacker with specific low-privileged broker access to manipulate the local filesystem, potentially leading to unauthorized file overwrite or system compromise depending on file write targets and permissions.\nThe risk implication is moderate to high due to the potential for privilege escalation or persistent system tampering if critical application files are overwritten. Exploitation requires prior authentication with the OnPrem Broker role and the ability to interact with the Automation Broker log upload mechanism using specially crafted filename payloads.",
  "technicalDetails": "The vulnerability resides within the Automation Broker log upload component of Splunk SOAR versions below 8.6.0. The vulnerable component fails to properly validate and sanitize filename inputs supplied during log upload requests, resulting in a classic path traversal condition.\nThe root cause is the direct utilization of untrusted filename parameters in filesystem write operations. When an authenticated user submits log files with crafted path traversal sequences (such as dot-dot-slash sequences) within the filename parameter, the underlying application logic resolves the path relative to the root filesystem or parent directories rather than confining the write operations strictly within the intended Automation Broker log directory.\nThe attack flow proceeds as follows: 1) An authenticated user possessing the OnPrem Broker role initiates a log upload request to the Automation Broker. 2) The attacker supplies a maliciously crafted filename containing directory traversal patterns within the upload parameters. 3) The Automation Broker component processes the input without adequate neutralization of traversal sequences. 4) The application writes the payload or log contents to the resolved absolute or relative path outside the secure log directory, allowing file creation or overwriting in unintended filesystem locations.\nExploitation requires valid authentication credentials and assignment of the OnPrem Broker role, indicating that the threat actor must already possess specific low-level administrative or broker-tier access within the Splunk SOAR environment. The network exposure is constrained by the accessibility of the Automation Broker interface. Post-exploitation impact depends heavily on the targeted file paths, potentially permitting configuration tampering, code execution, or denial of service if critical system or application binaries and configuration files are overwritten."
}