CVE-2026-76358 in SOAR
Summary
by MITRE • 08/19/2026
In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file paths stay within the intended destination directory. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Add and configure apps and assets to provide actions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises) in the Splunk documentation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
A critical path traversal vulnerability exists within the application installation mechanism of Splunk SOAR versions prior to 8.6.0, specifically affecting on-premises deployments. This flaw arises from an insufficient validation check during the archive extraction routine used when installing new applications or playbooks into the platform. The system is designed to extract files from a provided archive package into a designated temporary directory before finalizing their placement within the application structure. However, the implementation fails to rigorously verify that each file path contained within the extracted archive remains strictly confined to this intended destination directory. Consequently, an attacker can craft a malicious archive containing entries with relative paths such as ../../ or absolute paths pointing outside the sandboxed environment, thereby tricking the extraction logic into writing files to arbitrary locations on the underlying operating system filesystem.
The exploitation of this vulnerability requires a user account possessing app-install privileges within the Splunk SOAR platform. This role is typically assigned to administrators or power users responsible for managing integrations and automation workflows. By leveraging these elevated permissions, an authenticated attacker can upload a specially crafted archive file through the standard application installation interface. The lack of proper path normalization or canonicalization allows the malicious paths to bypass directory containment controls. Once extracted, files are written directly to locations determined by the attacker rather than being restricted to the secure temporary workspace. This represents a classic insecure direct object reference combined with path traversal, allowing for unauthorized file system writes that extend beyond the application's intended scope.
The operational impact of this vulnerability is severe, as it effectively grants an authenticated user arbitrary write access to the server hosting Splunk SOAR. Depending on the permissions under which the Splunk service runs, an attacker could overwrite critical configuration files, inject malicious scripts into executable directories, or place web shells in accessible locations. This capability can lead to full system compromise, allowing for remote code execution, data exfiltration, and lateral movement within the network environment where SOAR is deployed. Since Splunk SOAR serves as a central hub for security operations, compromising its integrity undermines trust in automated incident response actions and potentially exposes sensitive threat intelligence or customer data stored within the platform. The vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements that can cause paths to be resolved outside of restricted directories.
To mitigate this risk, organizations running Splunk SOAR on-premises must immediately upgrade to version 8.6.0 or later, where the path traversal flaw has been addressed through improved input validation and strict directory confinement during archive extraction processes. Until an upgrade is feasible, administrators should restrict app-install privileges to only those users who absolutely require them, adhering to the principle of least privilege as outlined in Splunk SOAR role management documentation. Additionally, deploying file integrity monitoring solutions can help detect unauthorized changes to system files resulting from exploitation attempts. From a threat intelligence perspective, this vulnerability maps to MITRE ATT&CK technique T1505.003: Server Software Component: Web Shell, as attackers may utilize the arbitrary write capability to deploy persistent backdoors for continued access and control over the compromised infrastructure.