CVE-2026-6855
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Apr 22, 2026
Vendor
unknown
Description
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.