Skip to content
OpenAdvisories
High · 7.1 CVE-2026-6855 EUVD-2026-24736GHSA-pqmg-c2j8-fq92PYSEC-2026-2521

Instructlab: instructlab: path traversal allows arbitrary directory creation and file write

Published Apr 22, 2026 · Updated Apr 24, 2026 · Assigned by redhat

Description

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 — —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI instructlab <= 0.26.1 — GHSA-pqmg-c2j8-fq92

References