CVE-2026-6855

High

Published: 22/04/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A flaw was found in InstructLab that allows a local attacker to exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This enables the attacker to create new directories and write files to arbitrary locations on the system.

Risk Assessment

This vulnerability could lead to unauthorized data modification or disclosure, posing a significant threat to the integrity and confidentiality of the system.

Recommendation

It is recommended to review and secure the handling of input parameters to prevent manipulation of the `logs_dir` parameter, as well as to implement appropriate access controls to the file system.

Other vulnerabilities in InstructLab

CVE-2026-6859High
The `linux_train.py` script in InstructLab hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/download/generate` with a specially crafted malicious model from the HuggingFace Hub.

Original NVD description (English source)

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.