CVE-2026-6855

[CVE catalog]

Severity

High · CVSS 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Published

Apr 15, 2026, 12:00:00 AM UTC

Source

[NVD] · [CVE record]

EPSS

0.16% · Oct 25, 2026

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure. instructlab: InstructLab: Path traversal allows arbitrary directory creation and file write This Moderate impact vulnerability in instructlab allows for path traversal due to an unsanitized `logs_dir` parameter within the chat session handler. An attacker could exploit this to create arbitrary directories and write files to arbitrary locations on the system. This affects Red Hat Enterprise Linux AI. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.