CVE-2026-81542
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw. A remote authenticated attacker could delete arbitrary files.
Risk Assessment
The ability to delete arbitrary files can cause data loss and service disruption. This is a serious threat to system availability and integrity.
Recommendation
Update IBM DataStage on Cloud Pak for Data to a patched version. Restrict privileges of authenticated accounts and maintain regular backups.
Other vulnerabilities in IBM DataStage on Cloud Pak for Data
See all- CVE-2026-82107Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authentication flaw that allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions.
- CVE-2026-82100Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal issue that allows a remote authenticated attacker to cause a denial of service.
- CVE-2026-80424Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
- CVE-2026-80435Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an XML External Entity (XXE) injection flaw. A remote authenticated attacker could obtain sensitive information.
- CVE-2026-16433Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
- CVE-2026-16427Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
- CVE-2026-16325Medium
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of input in the X-Forwarded-Host header.
- CVE-2026-84421High
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.
- CVE-2026-82094High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
- CVE-2026-82093High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.
Original NVD description (English source)
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS