An absolute-path traversal flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0 can be exploited by an authenticated attacker to read files outside the intended directory, potentially exposing sensitive information. The weakness is categorized as CWE-36, enabling arbitrary file disclosure. The impact is direct data leakage rather than denial of service or code execution, affecting confidentiality of the system and any files accessible through the traversal.

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected. The vendor recommends upgrading to DataStage 5.4 patch 8 or later. No other product versions or vendors are listed as impacted.

The CVSS score of 9.9 indicates a very high severity vulnerability. EPSS data is not available, and the issue is not currently listed in CISA's KEV catalog. The attack vector is likely remote, requiring authenticated access to the application, which can be a common scenario for privileged users or compromised credentials. The lack of an EPSS score introduces uncertainty about current exploitation prevalence, but the high CVSS combined with the nature of the flaw suggests a significant risk if not remediated.