Arbitrary file write via crafted search identifier

Path traversal in Splunk Enterprise before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 allows attackers to write arbitrary paths via a crafted search identifier. The Search Dispatch REST API uses the caller-supplied search identifier when creating a dispatch directory and does not validate traversal sequences before writing dispatch metadata on the host filesystem. Exploitation requires an authenticated Splunk user that lacks the admin or power roles, and the documented impact is integrity-only arbitrary metadata placement rather than direct code execution or data disclosure.