PYSEC-2026-2521
InstructLab vulnerable to Path Traversal
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-6855
- Alias
- GHSA-pqmg-c2j8-fq92
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · instructlab | introduced 0, last affected 0.26.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2026-6855 ADVISORY
- https://access.redhat.com/security/cve/CVE-2026-6855 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2460013 WEB
- https://github.com/instructlab/instructlab PACKAGE
- https://pypi.org/project/instructlab PACKAGE
- https://github.com/advisories/GHSA-pqmg-c2j8-fq92 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |