---
id: "CVE-2026-16427"
page: "https://infrastack.ai/live/CVE-2026-16427"
kind: "vulnerability"
aliases: ["CVE-2026-16427"]
title: "IBM DataStage: path traversal lets signed-in users write arbitrary files"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["cloud-pak-for-data", "ibm-datastage", "vendor"]
not_affected_if: ["no-datastage-5.4.0.0"]
published_at: "2026-11-08T18:17:02+00:00"
first_seen_at: "2026-11-08T18:22:22+00:00"
updated_at: "2026-11-08T18:22:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16427", "first_seen_at": "2026-11-08T18:22:22+00:00"}]
exploit_sources: []
---

# IBM DataStage: path traversal lets signed-in users write arbitrary files

Link for people: https://infrastack.ai/live/CVE-2026-16427 (this .md is for agents)

IBM DataStage on Cloud Pak for Data 5.4.0.0 has a path traversal flaw that lets a remote, logged-in user write files anywhere the service can reach. An attacker could overwrite files on the server, which may lead to code execution or data tampering, though the sources do not say how far that goes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether your Cloud Pak for Data deployment runs IBM DataStage at version `5.4.0.0`

## Timeline

- 2026-11-08T18:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16427

## From the sources

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_