The vulnerability is a path traversal flaw in the Universal Forwarder installer of Splunk SOAR. An attacker who can perform the installer’s archive extraction can cause files to be written outside the intended installation directory. The flaw stems from an unchecked extraction path and is a classic directory traversal weakness (CWE-22). If the attacker can place a malicious payload in an arbitrary location, subsequent execution could compromise system integrity and potentially enable full code execution on the host.

Splunk SOAR versions prior to 8.6.0 are affected. The flaw is present in all releases below 8.6.0 and can be exploited by users with the Administrator role.

The CVSS score of 6.5 rates the issue as moderate severity. Because the exploit requires Administrator privileges and the ability to run the installer, the likelihood of exploitation is limited to trusted users or compromised accounts. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation at this time. Nevertheless, the potential for privilege escalation and file system compromise warrants prompt action.