CVE-2026-76359: The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, the Universal Forwarder credentials-package extraction workflow fails to properly neutralize special elements in pathnames during archive extraction. This allows an Administrator user to perform path traversal attacks, writing files outside the intended installation directory. The root cause is the lack of verification that each archive member remains within the restricted directory before extraction.

The vulnerability allows an Administrator user to write files outside the intended installation directory during the Universal Forwarder installer's archive extraction. This can lead to unauthorized modification of files, potentially impacting system integrity and availability. Confidentiality impact is not indicated. The CVSS score is 6.5 (medium severity) with high impact on integrity and availability.

A fix is available in Splunk SOAR version 8.6.0. Users should upgrade to version 8.6.0 or later to remediate this vulnerability. No additional mitigation steps are indicated in the vendor advisory.