{"id":"CVE-2026-16427","kind":"vulnerability","aliases":["CVE-2026-16427"],"related":[],"title":"IBM DataStage: path traversal lets signed-in users write arbitrary files","description":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 has a path traversal flaw that lets a remote, logged-in user write files anywhere the service can reach. An attacker could overwrite files on the server, which may lead to code execution or data tampering, though the sources do not say how far that goes.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud-pak-for-data","ibm-datastage","vendor"],"not_affected_if":["no-datastage-5.4.0.0"],"how_to_check":"- Check whether your Cloud Pak for Data deployment runs IBM DataStage at version `5.4.0.0`","fix":null,"status":"open","published_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:44+00:00","updated_at":"2026-11-08T18:22:44+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T18:22:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM DataStage: path traversal lets signed-in users write arbitrary files","impact":"medium","summary":"IBM DataStage on Cloud Pak for Data 5.4.0.0 has a path traversal flaw that lets a remote, logged-in user write files anywhere the service can reach. An attacker could overwrite files on the server, which may lead to code execution or data tampering, though the sources do not say how far that goes.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ibm-datastage","cloud-pak-for-data"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user writes arbitrary files on the server","analyst_note":"Check the IBM security bulletin for DataStage 5.4.0.0 for the fixed version and affected configurations; NVD alone gives no fix.","how_to_check":"- Check whether your Cloud Pak for Data deployment runs IBM DataStage at version `5.4.0.0`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-datastage-5.4.0.0"],"who_is_affected":"Organizations running IBM DataStage 5.4.0.0 on IBM Cloud Pak for Data. The flaw requires a remote attacker with a valid account, so exposure depends on who holds user accounts on the platform. The sources do not say which configurations are affected beyond this version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4527,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16427':15A,18A '-2026':14A,17A '5.4.0.0':35B,90C 'allow':92C 'anywher':51B 'arbitrari':11A,99C 'attack':57B,96C 'authent':95C 'cloud':20B,31B,86C 'cloud-pak-for-data':19B 'code':68B 'could':58B,91C 'cve':13A,16A 'data':23B,34B,71B,89C 'datastag':2A,26B,29B,84C 'due':101C 'execut':69B 'far':80B 'file':12A,50B,60B,100C 'flaw':40B 'goe':82B 'ibm':1A,25B,28B,83C 'ibm-datastag':24B 'lead':66B 'let':5A,42B 'log':46B 'logged-in':45B 'may':65B 'overwrit':59B 'pak':21B,32B,87C 'path':3A,38B,104C 'reach':55B 'remot':44B,94C 'say':78B 'server':63B 'servic':53B 'sign':7A 'signed-in':6A 'sourc':75B 'tamper':72B 'though':73B 'travers':4A,39B,105C 'user':9A,48B 'vendor':27B 'vulner':106C 'write':10A,49B,98C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM DataStage 5.4.0.0 on IBM Cloud Pak for Data. The flaw requires a remote attacker with a valid account, so exposure depends on who holds user accounts on the platform. The sources do not say which configurations are affected beyond this version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudpakfordata","ibmdatastage","medium","vendor"],"campaign_type":null,"search_a":"'-16427':15A,18A '-2026':14A,17A 'arbitrari':11A 'cve':13A,16A 'datastag':2A 'file':12A 'ibm':1A 'let':5A 'path':3A 'sign':7A 'signed-in':6A 'travers':4A 'user':9A 'write':10A","search_b":"'5.4.0.0':35B 'anywher':51B 'attack':57B 'cloud':20B,31B 'cloud-pak-for-data':19B 'code':68B 'could':58B 'data':23B,34B,71B 'datastag':26B,29B 'execut':69B 'far':80B 'file':50B,60B 'flaw':40B 'goe':82B 'ibm':25B,28B 'ibm-datastag':24B 'lead':66B 'let':42B 'log':46B 'logged-in':45B 'may':65B 'overwrit':59B 'pak':21B,32B 'path':38B 'reach':55B 'remot':44B 'say':78B 'server':63B 'servic':53B 'sourc':75B 'tamper':72B 'though':73B 'travers':39B 'user':48B 'vendor':27B 'write':49B","search_c":"'5.4.0.0':90C 'allow':92C 'arbitrari':99C 'attack':96C 'authent':95C 'cloud':86C 'could':91C 'data':89C 'datastag':84C 'due':101C 'file':100C 'ibm':83C 'pak':87C 'path':104C 'remot':94C 'travers':105C 'vulner':106C 'write':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16427","severity":null,"published_at":"2026-11-08T18:17:02+00:00","modified_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}