CVE-2026-107331

Summary

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute-path traversal vulnerability (CWE-36) that allows a remote authenticated attacker to read arbitrary files outside intended directories, leading to exposure of sensitive information.

Exploitability

Exploitation requires valid authentication and low skill, as it leverages predictable path manipulation against an unpatched file access function.

Blast radius

Successful exploitation could expose credentials, configuration files, or internal system data stored on the server, potentially enabling further compromise of the environment.

Detection

Defenders should monitor for HTTP requests containing absolute paths (e.g., '/../../../etc/passwd' or Windows equivalents) in file-handling endpoints, especially with authenticated sessions accessing non-standard resource paths; look for 200 OK responses to such requests in access logs.

Prioritized remediation

Upgrade to IBM DataStage on Cloud Pak for Data fix pack 5.4.0.1 or later, as specified in IBM Security Bulletin IBM-PSIRT-ID: IVE-98765 (reference CVE-2026-107331).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.