CVE-2026-76358: The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, the archive extraction routine used during app installation does not properly neutralize special elements in file paths. This allows a user with app-install privileges to perform a path traversal attack, causing files to be written outside the intended temporary directory. The vulnerability arises because the software does not validate that extracted file paths stay within the intended destination directory, potentially leading to unauthorized file writes.

An attacker with app-install privileges can exploit this vulnerability to write files outside the restricted temporary directory. This could lead to unauthorized modification of files or directories, potentially impacting the integrity and availability of the system. The CVSS 3.1 score is 6.5 (medium severity) with impact on integrity and availability but no confidentiality impact.

The vulnerability affects Splunk SOAR versions prior to 8.6.0. Users should upgrade to version 8.6.0 or later where this issue is resolved. Since this is an on-premises product, administrators should review and restrict app-install privileges to trusted users only until the upgrade is applied. Patch status is not explicitly stated in the input, but the affected versions indicate that 8.6.0 is the fixed version. Check the vendor advisory for official patch and remediation guidance.