IBM DataStage on Cloud Pak for Data: Path traversal allows code execution
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw (CWE-22) caused by improper validation of pathnames. According to IBM's description, a remote attacker with a valid user account can exploit it over the network without user interaction to execute arbitrary code. NVD rates the issue 9.9 (critical), while IBM's bulletin rates it 9.6 with no confidentiality impact. No public exploit is known.
Affected
- IBM DataStage on Cloud Pak for Data 5.4.0.0
Fixed in
- Upgrade to 5.4 patch 7 or later, as stated in the official CVE record (IBM is the CNA).
- Note: IBM's open-source bulletin for DataStage refers to 5.4 patch 8 or later. Confirm the exact fixed level in IBM bulletin 7288649 or with IBM support before planning the upgrade.
Workaround
- No vendor workaround is known.
- Restrict network access to DataStage to trusted internal networks and administrative interfaces.
- Limit and review DataStage user accounts, since exploitation requires a valid account.
Exploitation
- No public proof of concept has been reported.
- Not listed in the CISA KEV catalog according to secondary sources.
- The CISA SSVC assessment in the CNA record states exploitation: none and automatable: no.
- EPSS is about 0.005 (low).
- No exploitation in the wild has been found.
Our recommendation
- Check whether any DataStage on Cloud Pak for Data 5.4.0.0 instance is in use.
- Obtain the fixed patch level from IBM bulletin 7288649 or IBM support and upgrade promptly.
- Until patched, restrict network access, review accounts with DataStage access, and monitor logs for unusual file access.
- Prioritise instances that are reachable from the internet or have many user accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7288649 www.ibm.com
- Vulners: RAPID7:CVE-2026-82110 vulners.com
- Strix: CVE-2026-82110 www.strix.ai
- TheHackerWire: CVE-2026-82110 www.thehackerwire.com
- ThreatInt: CVE-2026-82110 cve.threatint.com
- IBM Security Bulletin: DataStage open-source vulnerabilities www.ibm.com
- IBM Cloud Pak for Data v5.4 Patch 8 www.ibm.com
- SecurityOnline: IBM DataStage vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:30.
Original description (NVD)
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.