p PatchFirst

CVE-2026-6855

CVE-2026-6855 · Instructlab: instructlab: path traversal allows arbitrary directory creation and file write

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

CVSS 7.1 · High · EPSS 0.2%

Published
Updated

Stack: python

Affected products and versions

  • red hat enterprise linux ai (rhel ai) 3

    No fix published

  • instructlab PyPI

    Versions
    • 0.14.0
    • 0.15.1
    • 0.16.0
    • 0.16.1
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.18.0
    • 0.18.0a1
    • 0.18.0a2
    • 0.18.0a3
    • 0.18.0a4
    • 0.18.0a5
    • 0.18.0a6
    • 0.18.0a7
    • 0.18.0b1
    • 0.18.0b2
    • 0.18.0b3
    • 0.18.0b4
    • 0.18.0b5
    • 0.18.0b6
    • 0.18.0rc1
    • 0.18.0rc2
    • 0.18.0rc3
    • 0.18.0rc4
    • 0.18.0rc5
    • 0.18.0rc6
    • 0.18.0rc7
    • 0.18.1
    • 0.18.2
    • 0.18.3
    • 0.18.4
    • 0.19.0
    • 0.19.0a1
    • 0.19.0b1
    • 0.19.0rc1
    • 0.19.1
    • 0.19.2
    • 0.19.3
    • 0.19.4
    • 0.19.5
    • 0.20.0
    • 0.20.0a1
    • 0.20.0a2
    • 0.20.1
    • 0.21.0
    • 0.21.0a0
    • 0.21.0a1
    • 0.21.1
    • 0.21.2
    • 0.22.0
    • 0.22.1
    • 0.22.2
    • 0.23.0
    • 0.23.0a0
    • 0.23.0rc0
    • 0.23.1
    • 0.23.2
    • 0.23.3
    • 0.23.4
    • 0.23.5
    • 0.24.0
    • 0.24.1
    • 0.24.2
    • 0.24.2a0
    • 0.24.3
    • 0.25
    • 0.26.0
    • 0.26.0a1
    • 0.26.1
    Affected ranges
    • ECOSYSTEM: ≤ 0.26.1

    No fix published

Original sources

Check your server →