External risk intelligence

IBM DataStage Path Traversal Archive Extraction Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-80424

IBM DataStage on Cloud Pak for Data is a complex enterprise data integration platform. While it often functions as a backend or internal analytics tool, components may be network-reachable in some enterprise environments. However, it is not typically designed as a public-facing internet edge service, and exploitation requires prior authentication.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in IBM DataStage on Cloud Pak for Data could allow an authenticated user to create unintended files on the system by exploiting a path traversal flaw during archive handling. This could potentially impact system integrity and data confidentiality at a high level, depending on the attacker's access and the system's configuration.

Allows unauthorized file creation.
Could impact system integrity and data confidentiality.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with existing access to IBM DataStage on Cloud Pak for Data could exploit this vulnerability. By uploading a specially crafted archive file, the attacker could trick the system into writing files to unintended locations on the server, potentially leading to unauthorized data creation.

Requires prior authentication.
Triggered by uploading a malicious archive.
Risk of arbitrary file creation.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated attacker with network access could leverage path traversal during archive extraction to create arbitrary files on the system. This could lead to unauthorized file creation and potentially impact service behavior by overwriting critical system files or configuration data.

Arbitrary file creation on the system.
Path traversal during archive extraction.
Potential for service disruption or compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

IBM DataStage on Cloud Pak for Data is likely managed by platform or data engineering teams responsible for the overall Cloud Pak deployment. The first step is to confirm the exact deployment locations and business criticality of affected DataStage instances. Subsequently, coordinate with the accountable owners to plan remediation, considering the potential for remote, authenticated exploitation that allows arbitrary file creation.

Data platform and infrastructure teams own this.
Verify DataStage instance reachability and criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM DataStage on Cloud Pak for Data?

It is an enterprise-grade data integration platform used to design, develop, and run jobs that move and transform large volumes of data across complex IT environments. It acts as a central hub for data pipelines, allowing organizations to clean, consolidate, and prepare information from disparate sources for analytics and business operations.

What does CVE-2026-80424 mean by path traversal?

This vulnerability falls under the CWE-22 weakness class, known as Improper Limitation of a Pathname to a Restricted Directory. In this context, it means the software fails to properly sanitize file paths when extracting an archive. An attacker can use special characters, such as dot-dot-slash sequences, to escape the intended directory and write files to restricted areas of the server's filesystem.

How is the arbitrary file creation bug triggered?

The flaw is triggered when the system processes a specially crafted archive file. An attacker must have the ability to upload or provide such an archive to the DataStage component. Simply accessing the application without performing this specific archive extraction operation does not trigger the vulnerability.

Is my IBM DataStage instance at risk?

According to Halo Surface Signal, this software is a complex platform not typically designed for the public internet edge. However, it may be network-reachable in some enterprise environments. Because the vulnerability requires prior authentication, your primary focus should be on internal environments where users have legitimate access to the platform.

What should I do if I run this software?

Begin by identifying all deployed instances of DataStage on Cloud Pak for Data and determining their business criticality. Coordinate with your platform or data engineering teams to assess these instances for network reachability. Once identified, work with the accountable owners to prioritize remediation and monitor official IBM support channels for patches.

References

www.ibm.com/support/pages/node/7286562

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.