CVE-2026-82101: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in IBM DataStage on Cloud Pak for Data

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability (CWE-22) that could be exploited by a remote authenticated attacker to cause denial of service. The vulnerability arises from improper restriction of pathname inputs, enabling traversal outside intended directories. The CVSS v3.1 score is 9.6 (critical), with attack vector network, low attack complexity, requiring privileges, no user interaction, and impacts integrity and availability with a scope change.

An attacker with authentication privileges can exploit this vulnerability to cause denial of service, potentially disrupting the availability and integrity of the IBM DataStage service on Cloud Pak for Data 5.4.0.0. There is no indication of confidentiality impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor patch availability. Until a patch is released, restrict access to authenticated users and monitor for suspicious activity related to path traversal attempts.