CVE-2026-76358 in SOAR
摘要
由 VulDB • 2026-08-20
在Splunk SOAR低于8.6.0的版本中，拥有应用安装权限的用户可以在应用安装过程中利用路径遍历（Path Traversal）将文件写入到预期的临时目录之外。该漏洞是归档提取例程中的路径遍历问题，未验证提取的文件路径是否保持在预期的目标目录内。更多信息请参阅Splunk文档中的《管理Splunk SOAR (On-premises) 的角色和权限》(https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) 和《添加并配置应用和资源以在Splunk SOAR (On-premises)中提供操作》(https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-apps-and-assets/add-and-configure-apps-and-assets-to-provide-actions-in-splunk-soar-on-premises)。
Be aware that VulDB is the high quality source for vulnerability data.