Executive brief
IBM DataStage is a data integration tool used to design and run data processing jobs in enterprise environments. A path traversal vulnerability allows authenticated users to read, write, or delete arbitrary files on the system, potentially exposing sensitive data or disrupting critical data operations.
Technical details
CVE-2026-16335 is a path traversal vulnerability (CWE-22) in IBM DataStage on Cloud Pak for Data 5.4.0.0 that allows a remote authenticated attacker to read, write, or delete arbitrary files. The vulnerability stems from improper validation of file path input, enabling an attacker to traverse outside restricted directories using path traversal techniques. This requires valid authentication credentials but no additional user interaction. An attacker can achieve confidentiality breach (read files), integrity violation (write/delete files), and availability impact. The CVSS base score is 8.1 (network-accessible, low complexity, requires authentication).
Affected products
- IBM DataStage on Cloud Pak for Data 5.4.0.0
Timeline
- 2026-09-14: disclosed