high7.1
CVE-2026-6855
InstructLab vulnerable to Path Traversal
Impact
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | instructlab | <= 0.26.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Instructlab | All versions |
| Redhat | Enterprise Linux Ai | Version 3.0 |