CVE-2026-107331: DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Fixed in 5.4 patch 8
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker who is authenticated to IBM DataStage on Cloud Pak for Data could exploit it. The provided information does not identify any additional role or privilege requirements beyond authentication.
What impact could successful exploitation have?
Successful exploitation could allow the attacker to obtain sensitive information through absolute-path traversal. The supplied severity vector also rates impacts to confidentiality, integrity, and availability as high.
Is unauthenticated or user-assisted exploitation indicated?
No. The vector indicates privileges are required and user interaction is not required (PR:L/UI:N). It also indicates the attack can be performed over the network with low attack complexity.