A high-severity absolute path traversal vulnerability in IBM DataStage on Cloud Pak for Data allows authenticated remote attackers to compromise sensitive system information.

This vulnerability is an absolute path traversal flaw (CWE-36) where a remote attacker with authenticated access can leverage improper input validation to read arbitrary files from the filesystem.

The ability to perform path traversal allows an attacker to bypass directory restrictions and access sensitive configuration files, credentials, or system data. With a CVSS score of 8.8, this vulnerability poses a significant risk to data confidentiality and integrity, potentially leading to a full system compromise. Organizations should prioritize patching to prevent unauthorized data exfiltration and maintain compliance requirements.

Immediate Action: Upgrade IBM DataStage on Cloud Pak for Data to version 5.4 patch 5 or later as specified in the official IBM support documentation.

Proactive Monitoring: Review system access logs for suspicious file path patterns or unauthorized attempts to access directories outside of the intended application scope.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts, such as requests containing absolute paths or escape characters.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

Given the high CVSS score of 8.8, this vulnerability represents a significant risk to the security of the IBM DataStage environment. Security teams must ensure that the transition to version 5.4 patch 5 is performed immediately to remediate the underlying flaw. Failure to apply the vendor-supplied fix leaves the system vulnerable to unauthorized information disclosure and potential follow-on attacks.