CVE-2026-6855

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2026-6855	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2460013	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:instructlab:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux_ai:3.0:::::::*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un fallo en InstructLab. Un atacante local podría explotar una vulnerabilidad de salto de ruta en el gestor de sesiones de chat manipulando el parámetro ’logs_dir’. Esto permite al atacante crear nuevos directorios y escribir archivos en ubicaciones arbitrarias del sistema, lo que podría llevar a la modificación o divulgación no autorizada de datos.

Information

Published : 2026-04-22 13:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-6855

Mitre link : CVE-2026-6855

CVE.ORG link : CVE-2026-6855

JSON object : View

Products Affected

redhat

enterprise_linux_ai
instructlab

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-6855", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6855", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-23T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-aws-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-azure-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-azure-rocm-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-gcp-cuda-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "rhelai3/bootc-rocm-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-22T13:16:22.410", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-6855", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460013", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en InstructLab. Un atacante local podr\u00eda explotar una vulnerabilidad de salto de ruta en el gestor de sesiones de chat manipulando el par\u00e1metro \u2019logs_dir\u2019. Esto permite al atacante crear nuevos directorios y escribir archivos en ubicaciones arbitrarias del sistema, lo que podr\u00eda llevar a la modificaci\u00f3n o divulgaci\u00f3n no autorizada de datos."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:instructlab:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F16DE2EF-B42B-4D18-B9E4-3114EBBD65B1"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_ai:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "531FF57A-65AE-482C-9A43-D1F2ECAD6ED0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}