CVE-2026-6855: InstructLab vulnerable to Path Traversal

April 22, 2026 (updated April 29, 2026)

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the logs_dir parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

References

access.redhat.com/security/cve/CVE-2026-6855
bugzilla.redhat.com/show_bug.cgi?id=2460013
github.com/advisories/GHSA-pqmg-c2j8-fq92
nvd.nist.gov/vuln/detail/CVE-2026-6855

Code Behaviors & Features

Detect and mitigate CVE-2026-6855 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →