IBM DataStage EUVD-2026-89197

Requires a valid authenticated DataStage account (PR:L) with the ability to supply an archive to the application's extraction routine; the attack works remotely over the network (AV:N) with low complexity and no user interaction. The core prerequisite is reaching the archive-extraction feature of IBM DataStage on Cloud Pak for Data 5.4.0.0 with an attacker-controlled archive containing traversal path entries. Limiting factors: authentication is mandatory (this is not an unauthenticated flaw), only version 5.4.0.0 is named as affected, and the target is an enterprise Cloud Pak for Data deployment rather than a broadly internet-exposed service, which narrows the realistic attacker population to those with existing platform credentials or a foothold.

This is a genuine priority for organizations running the affected IBM DataStage on Cloud Pak for Data 5.4.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no user interaction, requiring only low privileges (PR:L - an authenticated but not necessarily administrative account) and yielding full compromise (C:H/I:H/A:H) via arbitrary code execution - a classic 'zip slip' path-traversal-to-RCE (CWE-22) during archive extraction. Counterbalancing the high base score: exploitation is gated behind authentication, and the product is enterprise-only rather than internet-mass-scannable, so real-world exposure is narrower than the raw score suggests. On the SSVC/threat axis there is no EPSS score, no CISA KEV listing, and no public exploit provided in the input, so exploitation status is: no public exploit identified at time of analysis. No signals conflict here - the vendor-provided CVSS, the description, and the CWE all agree that this is a network-facing, authenticated RCE. The main uncertainty is the exact privilege level PR:L maps to inside DataStage's role model; verify with the IBM advisory whether a standard project user (not just an admin) can reach the vulnerable extraction path.

An attacker with a low-privileged but valid DataStage account uploads or supplies a malicious archive (e.g., a ZIP/TAR) containing entries with directory-traversal path names such as '../../'. During extraction the application fails to sanitize the entry paths, writing files outside the intended directory - for example dropping an executable or script into a location the server later runs - resulting in arbitrary code execution on the host. No public proof-of-concept is referenced in the provided data, though zip-slip patterns are well understood and straightforward to weaponize.