The flaw is a directory traversal in the app installation REST endpoint that does not constrain the installation path to the specified app directory. A user who possesses both edit_local_apps and install_apps capabilities can supply a crafted value for the explicit_appname parameter, causing the installation handler to write files anywhere under $SPLUNK_HOME/etc. This can be used to overwrite existing configuration files or drop malicious payloads, thereby compromising the integrity and availability of the Splunk platform. The weakness is identified as CWE‑22.

Affects Splunk Enterprise versions earlier than 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, as well as Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.6, 10.2.2510.18, and 10.1.2507.24. Users who have the install_apps and edit_local_apps capabilities on these platforms are at risk.

The CVSS score of 7.2 indicates a medium‑to‑high severity. The EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through authenticated API calls where a user with the relevant capabilities submits a malicious installation request; no additional network exposure is required. Successful exploitation allows placement of arbitrary files in $SPLUNK_HOME/etc, potentially enabling configuration tampering or code execution.