Authenticated file write via bundle path validation bypass

Improper access control in Splunk Enterprise 10.4 before 10.4.2 allows remote authenticated users to write files via the cluster bundle REST API. The search head cluster member bundle REST API accepts bundle content without enforcing the intended search-head-clustering authorization boundary and without validating the supplied bundle path before writing it to disk. Exploitation requires a high-privilege Splunk role that can manage search head clustering, and the resulting write primitive can reach locations writable by the Splunk service account, enabling code execution and compromise of Splunk-managed data and service availability.