CVE-2026-82094: DataStage on Cloud Pak for Data has several vulnerabilities
DataStage on Cloud Pak for Data could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
Other sources
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataStage on Cloud Pak for Datato a version that resolves this vulnerability.Patch patch 7
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be remote and authenticated. The available information does not indicate that unauthenticated users can exploit it.
What is the likely impact of successful exploitation?
An authenticated attacker could traverse directories outside the intended restricted directory. The provided information does not specify which files or directories could be accessed or whether modification is possible.
Are default deployments affected?
The available information does not state whether the vulnerable behavior is enabled or reachable in a default DataStage on Cloud Pak for Data deployment.