CVE-2026-76369: The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, the Automation Broker component accepts crafted filename input when uploading log files. Due to improper neutralization of special elements in the pathname, an attacker with the OnPrem Broker role can cause the pathname to resolve outside the restricted Automation Broker log directory, enabling unauthorized file writes outside the intended directory.

The vulnerability allows users with the OnPrem Broker role to write files outside the designated Automation Broker log directory. This could potentially lead to unauthorized file creation or modification on the system, but does not impact confidentiality or availability according to the CVSS vector. The overall severity is low.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict the OnPrem Broker role to trusted users only and monitor for unusual file write activities related to Automation Broker logs.