IBM DataStage CVE-2026-107331

Requires a valid authenticated account on IBM DataStage on Cloud Pak for Data 5.4.0.0 (PR:L), reachable over the network (AV:N); no user interaction is required (UI:N). The specific feature, endpoint, or parameter that accepts the attacker-supplied absolute path is not described in the available sources. The primary limiting factor is the need for authenticated access - this is not an unauthenticated flaw - which reduces exposure to insiders or attackers who have already obtained low-privileged credentials; affected version is specifically 5.4.0.0.

Multiple signals point to genuine priority: the input assigns CVSS 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (network reachable, low complexity, only low privileges needed, scope changed), and the vuln.today Decision label is act_now with a vendor patch already available. However, the signals are internally inconsistent: the description states only that an attacker can 'obtain sensitive information' (a confidentiality impact consistent with CWE-36 absolute-path traversal), yet the supplied CVSS vector also claims High integrity and High availability impact and a scope change - the description does not substantiate I:H or A:H, so the 9.9 likely overstates real-world impact for an information-disclosure flaw. No EPSS score was provided, so statistical exploitation probability is unknown. This is not confirmed actively exploited and no public exploit was identified; the act_now label appears driven by the high vendor-reported CVSS and patch availability rather than observed exploitation. Net: treat as a real, patch-promptly priority for IBM DataStage on Cloud Pak for Data operators, but note the impact breadth (I/A) is unverified against the description.

A remote attacker who already holds valid low-privileged credentials on an IBM DataStage on Cloud Pak for Data 5.4.0.0 deployment submits a request containing a crafted absolute file path, causing the application to read and return a file outside the intended directory. This yields disclosure of sensitive files (e.g., configuration or credential material). No public exploit code was identified at the time of analysis, and the precise trigger (which endpoint or parameter accepts the path) is not described in the available sources.