{"id":"CVE-2026-107331","kind":"vulnerability","aliases":["CVE-2026-107331"],"related":[],"title":"IBM DataStage on Cloud Pak for Data: path traversal leaks sensitive files","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 has an absolute-path traversal flaw (CWE-36). A remote authenticated attacker can obtain sensitive information. IBM rates it CVSS 9.9 and fixes it in 5.4 patch 8; it lists no workarounds.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DataStage on Cloud Pak for Data","fixed":["5.4 patch 8"],"affected":"5.4.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","cloud-pak-for-data","ibm-datastage","vendor"],"not_affected_if":["other-version","patch-8-or-later"],"how_to_check":"Check the DataStage on Cloud Pak for Data service version and patch level in the Cloud Pak for Data / Software Hub console or CLI. Version 5.4.0.0 without 5.4 patch 8 or later is affected. Also review which authenticated users can reach DataStage, since exploitation needs a valid login. IBM does not state which files are exposed.","fix":"Upgrade DataStage on Cloud Pak for Data to 5.4 patch 8 or later (IBM bulletin 7294270)","status":"open","published_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:22:00+00:00","triaged_at":"2026-11-08T17:22:04+00:00","updated_at":"2026-11-08T17:23:24+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-08T17:22:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"IBM DataStage on Cloud Pak for Data: path traversal leaks sensitive files","impact":"medium","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an absolute-path traversal flaw. A remote attacker with valid credentials can read sensitive information from the server.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-datastage","cloud-pak-for-data"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive server files readable by an authenticated remote user","analyst_note":"Find IBM's bulletin for CVE-2026-107331 to confirm affected versions, the fixed release and the exact sensitive data exposed.","how_to_check":"- Confirm whether the deployment runs IBM DataStage on Cloud Pak for Data at version `5.4.0.0`\n- unknown for other checks: the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-version"],"who_is_affected":"Organisations running IBM DataStage on Cloud Pak for Data 5.4.0.0 are affected, as the sources name only that version. The attacker must be an authenticated remote user. Teams not running this product can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4531,"output_tokens":506,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find IBM's bulletin for CVE-2026-107331 to confirm affected versions, the fixed release and the exact sensitive data exposed.","search":"'-107331':15A,18A '-2026':14A,17A '-36':53B '5.4':71B '5.4.0.0':44B,85C '8':73B '9.9':66B 'absolut':48B,100C 'absolute-path':47B,99C 'allow':87C 'attack':57B,91C 'auth':26B 'auth-requir':25B 'authent':56B,90C 'cloud':4A,21A,29B,40B,81C 'cloud-pak-for-data':28B 'could':86C 'cve':13A,16A 'cvss':65B 'cwe':52B 'data':7A,24A,32B,43B,84C 'datastag':2A,35B,38B,79C 'datastage':19A 'due':96C 'file':12A 'fix':68B 'flaw':51B 'for':23A 'ibm':1A,34B,37B,62B,78C 'ibm-datastag':33B 'inform':61B,95C 'leak':10A 'list':75B 'obtain':59B,93C 'on':20A 'pak':5A,22A,30B,41B,82C 'patch':72B 'path':8A,49B,101C 'rate':63B 'remot':55B,89C 'requir':27B 'sensit':11A,60B,94C 'travers':9A,50B,102C 'vendor':36B 'vulner':103C 'workaround':77B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM DataStage on Cloud Pak for Data 5.4.0.0 that have not applied 5.4 patch 8 or later. An attacker needs a valid login and network access, and can read sensitive information via absolute-path traversal; IBM does not say which data. Teams not running this product, or already on patch 8 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T17:23:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2198},"products":{"at":"2026-11-08T17:23:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2198},"workarounds":{"at":"2026-11-08T17:23:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2198},"how_to_check":{"at":"2026-11-08T17:23:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2198},"who_affected":{"at":"2026-11-08T17:23:24Z","by":"analyst","doc":"https://www.ibm.com/support/pages/node/7294270","run_id":2198}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["datastageoncloudpakfordata","oncloudpakfordata"],"ptokens":["cloud","data","datastage","for","on","pak"],"labels":["authrequired","cloudpakfordata","critical","ibmdatastage","vendor"],"campaign_type":null,"search_a":"'-107331':15A,18A '-2026':14A,17A 'cloud':4A,21A 'cve':13A,16A 'data':7A,24A 'datastag':2A 'datastage':19A 'file':12A 'for':23A 'ibm':1A 'leak':10A 'on':20A 'pak':5A,22A 'path':8A 'sensit':11A 'travers':9A","search_b":"'-36':53B '5.4':71B '5.4.0.0':44B '8':73B '9.9':66B 'absolut':48B 'absolute-path':47B 'attack':57B 'auth':26B 'auth-requir':25B 'authent':56B 'cloud':29B,40B 'cloud-pak-for-data':28B 'cvss':65B 'cwe':52B 'data':32B,43B 'datastag':35B,38B 'fix':68B 'flaw':51B 'ibm':34B,37B,62B 'ibm-datastag':33B 'inform':61B 'list':75B 'obtain':59B 'pak':30B,41B 'patch':72B 'path':49B 'rate':63B 'remot':55B 'requir':27B 'sensit':60B 'travers':50B 'vendor':36B 'workaround':77B","search_c":"'5.4.0.0':85C 'absolut':100C 'absolute-path':99C 'allow':87C 'attack':91C 'authent':90C 'cloud':81C 'could':86C 'data':84C 'datastag':79C 'due':96C 'ibm':78C 'inform':95C 'obtain':93C 'pak':82C 'path':101C 'remot':89C 'sensit':94C 'travers':102C 'vulner':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107331","severity":null,"published_at":"2026-11-08T17:16:35+00:00","modified_at":"2026-11-08T17:16:35+00:00","first_seen_at":"2026-11-08T17:22:00+00:00","fetched_at":"2026-11-08T17:22:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107331:2198","url":"https://www.ibm.com/support/pages/node/7294270","severity":null,"published_at":"2026-11-08T17:23:24+00:00","modified_at":"2026-11-08T17:23:24+00:00","first_seen_at":"2026-11-08T17:23:24+00:00","fetched_at":"2026-11-08T17:23:24+00:00","note":"Read IBM bulletin 7294270 (27 Oct 2026): affects DataStage on CP4D 5.4.0.0, fix is 5.4 patch 8 or later, no workarounds. IBM CVSS 9.9 (S:C). Bulletin does not say which files/data are exposed. No exploitation or PoC found; X not checked.","cites":["https://www.ibm.com/support/pages/node/7294270"]}],"documents":[{"id":102707,"url":"https://www.ibm.com/support/pages/node/7294270","title":"IBM Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities (7294270)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}