CVE-2026-6855 — Instructlab: instructlab: path traversal allows arbitrary directory creation and file write
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows …
Published: 2026-04-22 · CVSS: 7.1 · CVSS 3.1
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7