IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a CWE-22 path traversal vulnerability that could allow a remote authenticated attacker to access directories outside the intended restricted directory. This occurs because the software does not properly limit pathnames, enabling directory traversal attacks. The CVSS 3.1 base score is 7.1, reflecting network attack vector, high privileges required, no user interaction, and impacts on integrity and availability.

An attacker with low privileges who is authenticated remotely could exploit this vulnerability to traverse directories on the system, potentially leading to unauthorized modification of data (integrity impact) and partial denial of service (availability impact). Confidentiality is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, monitor IBM's advisories for updates. In the meantime, restrict access to authenticated users and apply principle of least privilege to limit potential exploitation.