Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

IBM DataStage on Cloud Pak for Data enables file creation

CVE-2026-80424 · published 1 month ago
Summary

When a user who is already logged in accesses IBM DataStage on Cloud Pak for Data version 5.4.0.0, the system can be tricked into writing files anywhere it wants. This could let an attacker place malicious files on the server, potentially leading to further compromise. Apply the vendor's update or patch as soon as possible and restrict who can upload archives.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm datastage on cloud pak for data 5.4.0.0
Original advisory text
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published10 Sep 2026
Updated11 Oct 2026
First seen10 Sep 2026
Sources
CVE-2026-80424 · NVD
CVE-2026-80424 · MITRE
Track software like this
Free during beta