cve/2023/CVE-2023-40597.md

### [CVE-2023-40597](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40597)
![](https://img.shields.io/static/v1?label=Product&message=Splunk%20Cloud&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Splunk%20Enterprise&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=-%3C%209.0.2305.200%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=8.2%3C%208.2.12%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=The%20software%20uses%20external%20input%20to%20construct%20a%20pathname%20that%20should%20be%20within%20a%20restricted%20directory%2C%20but%20it%20does%20not%20properly%20neutralize%20absolute%20path%20sequences%20such%20as%20%2Fabs%2Fpath%20that%20can%20resolve%20to%20a%20location%20that%20is%20outside%20of%20that%20directory.&color=brighgreen)

### Description

In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds