The flaw is a path traversal vulnerability that permits an authenticated attacker to run arbitrary commands on IBM DataStage on Cloud Pak for Data, version 5.4.0.0. Exploitation would give the attacker command execution rights on the platform, enabling data manipulation, exfiltration, or takeover. The weakness is identified as CWE-22.

IBM DataStage on Cloud Pak for Data, version 5.4.0.0, is affected. Updating to any release that includes patch 7 or later removes the vulnerability. The product is documented under version 5.4 and can be identified by its IBM product name and version.

The CVSS score of 8.8 classifies the vulnerability as high severity. EPSS indicates a low but nonzero exploitation probability (<1%). It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires the attacker to be already authenticated to the DataStage environment; once authenticated, the path traversal can be used to execute arbitrary commands. The risk window exists as long as the affected version remains in use and credentials are known.