EUVD-2026-75773
GHSA-3xpj-g3hf-jp68
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
An authenticated user of IBM DataStage on Cloud Pak for Data 5.4.0.0 can abuse path traversal (CWE-22) in file path handling to write to or delete arbitrary files on the platform's shared storage, compromising data integrity and availability for other jobs and tenants using that storage. The flaw is remotely reachable with a valid low-privileged account (CVSS 8.1, AV:N/PR:L, C:N/I:H/A:H) and a vendor patch is available from IBM; there is no CISA KEV listing and no confirmed public exploit, and EPSS is a modest 0.50% (41st percentile), indicating opportunistic rather than widespread exploitation pressure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Datastage On Cloud Pak For Data gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-accessible service requiring only low-privilege authentication; path traversal enables arbitrary read, write, and delete on shared storage with no interaction.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Arbitrary file read, write, and delete on IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible for an authenticated l
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid ac
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker holding a valid pla
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 can be triggered by a remote user who already holds val
Improper authentication in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated (low-privileged) at
Arbitrary file creation in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to write f
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-priv
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitr
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote user execute arbitrary
Exploit-DB