This vulnerability involves improper neutralization of special elements in pathnames during the app installation workflow in Splunk Enterprise and Splunk Cloud Platform. Users with roles containing the 'edit_local_apps' and 'install_apps' capabilities can exploit this to cause legitimate app installations to write files outside the intended app directory, specifically into $SPLUNK_HOME/etc/ and its subdirectories. Affected versions include Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24. The vulnerability has a CVSS 3.1 base score of 7.2 with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a user with specific app installation privileges to write files outside the intended app directory, potentially leading to unauthorized modification of configuration files or other sensitive data within $SPLUNK_HOME/etc/. This can compromise the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict roles with 'edit_local_apps' and 'install_apps' capabilities to trusted users only to minimize risk. Monitor for updates from Splunk regarding patches or official mitigations.