CVE-2026-82092

IBM DataStage, when deployed within IBM Cloud Pak for Data 5.4.0.0, contains an absolute path traversal flaw (CWE-36), meaning the application fails to neutralize fully-qualified file paths supplied in requests and can therefore be directed to files outside the intended directory. A remote attacker who already holds valid credentials can trigger the flaw over the network by submitting a path that points at arbitrary locations on the server, such as system files. The practical payoff is disclosure of sensitive information — configuration files, secrets, or other data readable by the service — and IBM's CVSS rating of 8.8 also weights integrity and availability impacts as high. Only organizations running DataStage as part of Cloud Pak for Data version 5.4.0.0 are affected. There is currently no evidence of in-the-wild exploitation, no CISA KEV listing, and no known public proof-of-concept.

What to do: Inventory your environment to confirm whether DataStage is deployed on Cloud Pak for Data 5.4.0.0, and if so, apply the fix referenced in IBM's security bulletin as soon as it is available (IBM is the assigned CNA and will publish patched releases there). Until patched, restrict which authenticated accounts can reach DataStage file-handling functions and audit file-access logs for requests using absolute paths. Given the high CVSS score but absence of public PoCs or KEV listing, treat this as a routine high-severity patch cycle rather than an emergency.