Advisory · CVE-2026-107331
IBM DataStage path traversal can expose sensitive information
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability, rated critical at CVSS 9.9.
- Vendor
- IBM
- Product
- DataStage on Cloud Pak for Data
- Identifier / CWE
- CVE-2026-107331
CWE-36 - Action timing
- Immediate
Explain it like I’m five
DataStage is supposed to keep file access inside its own folders. A path traversal flaw lets a logged-in attacker hand it a path that climbs out of those folders and reads sensitive files elsewhere on the system.
- 01Authenticated access
A remote authenticated attacker reaches DataStage on Cloud Pak for Data.
- 02Traversal crafted
An absolute path is supplied that escapes the intended directory.
- 03File read
Sensitive information outside the allowed path is returned.
What happened
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. The record rates it critical at CVSS 9.9 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
IBM’s bulletin lists the affected version and the fix. DataStage handles data pipelines, so sensitive information in reach of a traversal is a serious exposure.
What to do
- Inventory DataStage on Cloud Pak for Data deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Review access logs for traversal patterns.
- Determine which files were reachable from the DataStage service.
- Verify the deployed version after updating.
Management note
A near-maximum score on a data platform deserves same-day attention. Find out what files were in reach, not just whether the patch is out.