CVE-2026-76357: The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. in Splunk Splunk SOAR

In Splunk SOAR versions prior to 8.6.0, the REST API accepts file paths from authenticated users without role restrictions. The software uses these paths to access files or directories under a restricted parent directory but does not properly neutralize special elements in the pathname. This flaw enables path traversal outside the intended directory, allowing arbitrary code execution by submitting crafted file paths.

An authenticated user with no assigned role can exploit this vulnerability to execute arbitrary code on the affected system. This can lead to system compromise, data loss, or service disruption. The CVSS 3.1 base score is 7.6, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

The vulnerability affects Splunk SOAR versions below 8.6.0. Users should upgrade to version 8.6.0 or later where this issue is fixed. Since the product is not a cloud service, remediation requires applying the official patch or upgrade. Check Splunk's official documentation and security advisories for the latest updates and instructions.