TI-2026-53413 Aliases CVE-2026-76358 GHSA-2qxp-mv5r-x6p7

Path Traversal through App Installation Tar Extraction in Splunk SOAR

LOW 29CWE-22Published 2026-08-19 · Updated 2026-08-20

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file paths stay within the intended destination directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00517 44th percentileScored 2026-11-07

Fix Fixed Splunk SOAR (Splunk): 8.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Splunk	Splunk SOAR	8.6 to before 8.6.0	8.6.0	Patch available	CNA

Splunk SOAR VendorSplunk Affected 8.6 to before 8.6.0 Fixed in 8.6.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:splunk:soar:::::on-premises:::*	before 8.6.0	Vulnerable	Splunk

cpe:2.3:a:splunk:soar:*:*:*:*:on-premises:*:*:* Versions before 8.6.0 Vulnerable ·Splunk

Remediation

Fix · CNA Splunk SOAR (Splunk) Fixed in 8.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-19
Splunk SOAR 8.6.0
15 records Highest priority Priority LOW 15 LOW
Other records, highest priority first
- TI-2026-53411 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOARPriority LOW 38
- TI-2026-53417 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOARPriority LOW 34
- TI-2026-53412 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOARPriority LOW 34
Show all 15 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-76358
2026-10-03 Alias added: GHSA-2qxp-mv5r-x6p7

References

Advisory 1

https://advisory.splunk.com/advisories/SVD-2026-0804

TI-2026-53411 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR CVSS 3.1HIGH 8.1
TI-2023-03711 Unauthenticated Log Injection In Splunk SOAR CVSS 3.1HIGH 8.6
TI-2026-53417 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR CVSS 3.1HIGH 7.4
TI-2026-53412 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR CVSS 3.1HIGH 7.6
TI-2026-53420 Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR CVSS 3.1MEDIUM 6.5
TI-2026-53419 Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR CVSS 3.1MEDIUM 6.5

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences