IBM DataStage bug can let attackers plant server files

Published September 11, 2026 CVE-2026-16338

IBM DataStage, a data integration tool inside IBM Cloud Pak for Data, has a critical flaw. A logged-in user can trick it into writing a file to a location on the server it should not be able to reach.

Severity
CriticalCVSS 3.1 · 9.9 · ibm.com
Fix
Fixed in 5.4 patch 5
Affected versions
5.4.0.0
Weakness
CWE-73
Affects
DataStage on Cloud Pak for Data
Exploited
Not confirmedNo confirmation recorded

How it works

  • An attacker needs a valid, authenticated account on the DataStage service.
  • That account can submit a file path value that DataStage does not properly validate before using it to write a file.
  • Because the path is not checked against the file's name or location, the attacker can steer where DataStage writes the resulting file.
  • IBM says this lets the attacker perform an arbitrary file write, meaning a file can land in a location the attacker chose rather than one the application intended, which can be used to place a malicious file on the underlying server.

What to do

Check which release of DataStage on Cloud Pak for Data your organization runs and compare it against version 5.4.0.0, the version IBM lists as affected in its bulletin.

Upgrade DataStage on Cloud Pak for Data to 5.4 patch 5 or later, following the instructions in IBM's security bulletin. IBM lists no workaround, so applying the patch is the fix.

Technical details

Affected software: DataStage on Cloud Pak for Data

CVE-2026-16338 (CWE-73, External Control of File Name or Path) scores 9.9 CVSS in IBM's bulletin for DataStage on Cloud Pak for Data 5.4.0.0. A remote authenticated attacker with low privileges and no user interaction can trigger an arbitrary file write because file paths are not validated before use, with a changed scope and high impact to confidentiality, integrity, and availability. It was published alongside two dozen other DataStage flaws, including path traversal, SSRF, and OS command injection, in the same bulletin. The fix is DataStage on Cloud Pak for Data 5.4 patch 5 or later.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source