What’s Vulnerable › Vulnerabilities

CVE-2022-26889: Path Traversal in search parameter results in external content injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-06 · updated 2026-06-17
• Weakness: CWE-20

Description

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing).

Affected products

• Splunk Enterprise: from 8.1.0 before 8.1.2 — fixed in 8.1.2

How to fix

Upgrade to a fixed version: Splunk Enterprise 8.1.2. Check the vendor advisory for mitigations.

References

• https://research.splunk.com/application/path_traversal_spl_injection/
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html
• https://research.splunk.com/application/path_traversal_spl_injection/
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html

Get alerted when CVE-2022-26889 or the next vulnerability affects your stack