CVE-2026-6855

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

• CWE-22

• https://access.redhat.com/security/cve/CVE-2026-6855Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2460013Issue Tracking, Vendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68533Concrete CMS below 9.5.3 conversation attachment uploaded en…2.3
• CVE-2026-68534Concrete CMS before 9.5.3 rendered Express entry labels as r…2.3
• CVE-2026-68535Concrete CMS Area API's block-create endpoint in versions 9.…4.3
• CVE-2026-68536Server-Side Request Forgery / Local File Inclusion in Apache…9.8
• CVE-2026-68537`fulgur` converts untrusted HTML/CSS into PDF, commonly on a…7.5
• CVE-2026-6854The My Calendar – Accessible Event Manager plugin for WordPr…7.5
• CVE-2026-68552Coturn is a free open source implementation of TURN and STUN…5.3
• CVE-2026-68553Coturn is a free open source implementation of TURN and STUN…7.1
• CVE-2026-68554Coturn is a free open source implementation of TURN and STUN…2.3
• CVE-2026-68555Coturn is a free open source implementation of TURN and STUN…6.5
• CVE-2026-68558Wekan is open source kanban built with Meteor. From 8.36 unt…8.5
• CVE-2026-68559Wekan is open source kanban built with Meteor. From 9.57 unt…6.5