The vulnerability is a path traversal flaw that allows a remote authenticated attacker to write arbitrary files, which can be leveraged to overwrite critical system files or upload malicious code and potentially execute it.

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected. The problem is fixed by upgrading to version 5.4 patch 8 or later, as documented by IBM.

The CVSS score of 6.5 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires remote authentication—an attacker must first compromise legitimate user credentials or gain unauthorized access. With that access, the path-traversal path can be used to create or overwrite files, leading to potential credential leakage or code execution. The lack of an EPSS score limits precise exploitation probability, but the attack vector is considered feasible in environments where DataStage interfaces are exposed.