CVE-2026-82094
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
Risk Assessment
The risk includes unauthorized access to files and directories outside the allowed area, potentially leading to exposure of sensitive data. The attack requires authentication but can be performed remotely.
Recommendation
Apply patches provided by IBM for DataStage on Cloud Pak for Data 5.4.0.0. Restrict system access to trusted users only.
Other vulnerabilities in IBM DataStage on Cloud Pak for Data
See all- CVE-2026-82107Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an improper authentication flaw that allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions.
- CVE-2026-82100Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal issue that allows a remote authenticated attacker to cause a denial of service.
- CVE-2026-80424Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.
- CVE-2026-82093High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.
- CVE-2026-81552High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.
- CVE-2026-81548High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-81547High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal.
- CVE-2026-81545High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-80412High
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly escapes connector property values during OSH script generation. A remote authenticated attacker could exploit this to execute arbitrary code.
- CVE-2026-80379High
IBM DataStage on Cloud Pak for Data 5.4.0.0 does not properly neutralize special elements used in OS commands. A remote authenticated attacker could exploit this to execute arbitrary commands.
Original NVD description (English source)
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS