Technical impact
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw that allows a remote authenticated attacker to specify an arbitrary file path, leading to execution of arbitrary code. The vulnerability arises from improper validation of pathname during processing, enabling the attacker to escape the intended directory and gain control over system commands. This flaw can compromise both confidentiality and integrity of the entire system by allowing full code execution on the host.
Affected Systems
The flaw affects IBM DataStage on Cloud Pak for Data version 5.4.0.0. No other product versions are currently listed as affected in the CNA data.
Risk and Exploitability
With a CVSS score of 9.6, the vulnerability is considered critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be authenticated to the DataStage service; however, once authentication is achieved, the flaw permits arbitrary code execution, making it a high‑risk scenario for compromised accounts. Normal exploitation would involve submitting a crafted request that includes a traversal path, causing the system to resolve the path outside the intended directory and execute injected code.
