CVE-2026-6855
A flaw was found in InstructLab.
Published Apr 22, 2026 · updated Jun 17, 2026 · redhat instructlab
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 22, 2026 · NIST NVD
Detected
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
Jun 17, 2026 · NIST NVD
Updated
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
Affected
- cpe redhat/enterprise linux ai3.0
- cpe redhat/instructlabversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-6855
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-6855
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentiall
nvd.nist.gov