CVE-2022-26889

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing).

• CWE-20
• CWE-22

• https://research.splunk.com/application/path_traversal_spl_injection/Vendor Advisory
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.htmlVendor Advisory
• https://research.splunk.com/application/path_traversal_spl_injection/Vendor Advisory
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.htmlVendor Advisory

Published

May 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26878drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.1…5.5
• CVE-2022-2688A vulnerability was found in SourceCodester Expense Manageme…9.8
• CVE-2022-26884Users can read any files by log server, Apache DolphinSchedu…6.5
• CVE-2022-26885When using tasks to read config files, there is a risk of da…7.5
• CVE-2022-26887Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-26888Cross-site scripting in the Intel(R) Quartus Prime Pro and S…4.1
• CVE-2022-2689A vulnerability classified as problematic has been found in …5.4
• CVE-2022-26890On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prio…7.5
• CVE-2022-26891Microsoft Edge (Chromium-based) Elevation of Privilege Vulne…8.3
• CVE-2022-26894Microsoft Edge (Chromium-based) Elevation of Privilege Vulne…8.3
• CVE-2022-26895Microsoft Edge (Chromium-based) Elevation of Privilege Vulne…8.3
• CVE-2022-26896Azure Site Recovery Information Disclosure Vulnerability4.9