CVE-2026-20297 is a path traversal vulnerability in Splunk Enterprise and Splunk Cloud Platform. It affects versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14 for Splunk Enterprise, and below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24 for Splunk Cloud Platform. The vulnerability allows a user with specific elevated roles ('edit_local_apps' and 'install_apps') to cause a legitimate app installation to write files outside the intended app directory, specifically into $SPLUNK_HOME/etc/ and its subdirectories. This occurs because the software does not properly sanitize pathnames, enabling traversal outside the restricted directory during app installation.

An attacker with the required elevated roles can write files outside the intended app directory, potentially overwriting or adding files in critical directories under $SPLUNK_HOME/etc/. This could lead to unauthorized code execution, configuration manipulation, or denial of service. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict roles with 'edit_local_apps' and 'install_apps' capabilities to trusted users only. Monitor app installation activities closely and validate app sources to reduce risk.