CVE-2026-76369

Katalog CVE

CVSS 2.7 · Low EPSS 0,35%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada splunk soar. Skor CVSS 3.1 2.7 (Low) menurut cisco.com.

Deskripsi (NVD)

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and About Splunk SOAR Automation Broker (https://help.splunk.com/en/splunk-soar/splunk-automation-broker/about-splunk-soar-automation-broker/about-splunk-soar-automation-broker) in the Splunk documentation.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

21 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

2.7 (Low), sumber cisco.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 27,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://advisory.splunk.com/advisories/SVD-2026-0804 advisory vendor