IBM DataStage on Cloud Pak for Data 5.4.0.0

Published September 10, 2026 CVE-2026-80424

IBM DataStage on Cloud Pak for Data lets a logged-in attacker plant files it should never be able to write. The attacker abuses how the tool unpacks archives, placing new files outside the folder they belong in.

Severity
CriticalCVSS 3.1 · 9.1
Fix
Fixed in 5.4 patch 5
Affected versions
5.4.0
Weakness
CWE-22Path Traversal
Exploit likelihood
0.38% in 30 daysEPSS, higher than 32% of known flaws
Affects
DataStage on Cloud Pak for Data
Exploited
Not confirmedNo confirmation recorded
EU ID
EUVD-2026-75787ENISA vulnerability database

How it works

  • An attacker who already has a low-privilege account on DataStage on Cloud Pak for Data submits an archive file for extraction.
  • The archive's internal file paths contain directory traversal sequences that DataStage does not strip out.
  • When DataStage unpacks the archive, it follows those paths instead of confining output to the intended folder.
  • That lets the attacker create files at other locations on the system, which the advisory rates as a high-impact integrity problem.

What to do

Check whether your organization runs DataStage on Cloud Pak for Data version 5.4.0.0; that exact build is the one IBM lists as affected. Compare your deployed version against the IBM security bulletin for CVE-2026-80424 to confirm the match.

Upgrade DataStage on Cloud Pak for Data to 5.4 patch 5 or later, following IBM's official update instructions. IBM states no workaround or mitigation exists for this flaw, so the patch is the only fix. Watch the same bulletin page for any later patch revisions if patch 5 is not yet available for your environment.

Technical details

CVE-2026-80424 is a CWE-22 path traversal flaw in DataStage on Cloud Pak for Data 5.4.0.0, scored CVSS 3.1 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L). A remote attacker with low privileges can trigger archive extraction that writes files to attacker-chosen paths outside the intended directory, affecting integrity more than confidentiality or availability. It is one of several separate CVEs IBM disclosed the same day for DataStage on Cloud Pak for Data; this entry covers only the archive-extraction path traversal, not the other listed flaws. IBM's fix is to upgrade to 5.4 patch 5 or later; no mitigation is offered.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact Low Some data can be read
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L Open in FIRST.org calculator

References

View Original Source