IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal flaw that allows a remote authenticated attacker to write arbitrary files, potentially altering critical configuration or executable files. This can be leveraged to tamper with the platform’s behavior, inject malicious code, or compromise data integrity.

The affected product is IBM DataStage on Cloud Pak for Data version 5.4.0.0. All installations of this version are affected; the vulnerability is mitigated by upgrading to patch 8 or later of the 5.4 release line.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploitation. However, it requires an authenticated session, so an attacker must obtain valid credentials. Once authenticated, the path traversal can be exploited to write files anywhere within the protected file system, which may lead to significant compromise of the system’s integrity.