CVE-2026-6855

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

• CWE-22

• https://access.redhat.com/security/cve/CVE-2026-6855Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2460013Issue Tracking, Vendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68501Sylius Mollie Plugin provides Mollie payment integration for…6.5
• CVE-2026-68502LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-te…9.8
• CVE-2026-68503LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-te…9.8
• CVE-2026-6851An Improper link resolution before file access ('link follow…7
• CVE-2026-6853Improper restriction of excessive authentication attempts vu…9.8
• CVE-2026-6854The My Calendar – Accessible Event Manager plugin for WordPr…7.5
• CVE-2026-68562A flaw was found in ansible-collection-redhat-leapp. An atta…6.2
• CVE-2026-68563A flaw was found in ansible-collection-redhat-leapp. When a …5.5
• CVE-2026-6857A flaw was found in camel-infinispan. This vulnerability inv…7.5
• CVE-2026-68574Rejected reason: Reserved via standalone CLI outside the OSI…
• CVE-2026-68575Rejected reason: Reserved via standalone CLI outside the OSI…
• CVE-2026-68576Rejected reason: Reserved via standalone CLI outside the OSI…