CVE-2026-76358: Path Traversal through App Installation Tar Extraction in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file paths stay within the intended destination directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOAR (On-premises)to a version that resolves this vulnerability.Fixed in 8.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Splunk SOAR user with app-install privileges. The provided information does not indicate that users without this privilege can exploit it.
Which deployments are affected?
Splunk SOAR versions below 8.6.0 are affected. Version 8.6.0 or later is not identified as affected in the provided advisory data.
What access does an attacker gain through exploitation?
An attacker can use a crafted app archive to write files outside the intended temporary extraction directory. The stated impact is integrity and availability impact; no confidentiality impact is listed.
What should be done if an immediate upgrade is not possible?
Restrict app-install privileges to trusted users and avoid installing untrusted app archives. This reduces exposure because exploitation depends on app-install access and a malicious archive.