CVE-2026-6855— Instructlab: instructlab: path traversal allows arbitrary directory creation and file write
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat Enterprise Linux AI是美国红帽（Red Hat）公司的一个为生成式 AI 打造的 Linux 发行版。 Red Hat Enterprise Linux AI存在路径遍历漏洞，该漏洞源于聊天会话处理程序存在路径遍历，本地攻击者可通过操纵logs_dir参数在系统任意位置创建目录和写入文件，可能导致未经授权的数据修改或泄露。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-6855
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Instructlab: instructlab: path traversal allows arbitrary directory creation and file write
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat Enterprise Linux AI 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Enterprise Linux AI是美国红帽（Red Hat）公司的一个为生成式 AI 打造的 Linux 发行版。 Red Hat Enterprise Linux AI存在路径遍历漏洞，该漏洞源于聊天会话处理程序存在路径遍历，本地攻击者可通过操纵logs_dir参数在系统任意位置创建目录和写入文件，可能导致未经授权的数据修改或泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | - |
cpe:/a:redhat:enterprise_linux_ai:3
|
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | - |
cpe:/a:redhat:enterprise_linux_ai:3
|
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | - |
cpe:/a:redhat:enterprise_linux_ai:3
|
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | - |
cpe:/a:redhat:enterprise_linux_ai:3
|
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | - |
cpe:/a:redhat:enterprise_linux_ai:3
|
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | - |
cpe:/a:redhat:enterprise_linux_ai:3
|
|
II. Public POCs for CVE-2026-6855
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6855
请登录查看更多情报信息。
Same Patch Batch · Red Hat · 2026-04-22 · 8 CVEs total
| CVE-2026-6859 | 8.8 HIGH | Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=tru |
| CVE-2026-6861 | 6.1 MEDIUM | Emacs: emacs: memory corruption vulnerability when processing svg css |
| CVE-2026-6862 | 5.5 MEDIUM | Efivar: efivar: denial of service due to stack overflow in device path node parsing |
| CVE-2026-6844 | 5.5 MEDIUM | Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files |
| CVE-2026-6843 | 5.5 MEDIUM | Nano: nano: format string vulnerability leads to denial of service |
| CVE-2026-6848 | 5.4 MEDIUM | Quay: red hat quay: authentication bypass allows privileged actions without valid credenti |
| CVE-2026-6845 | 5.0 MEDIUM | Binutils: binutils: denial of service via crafted elf file |
IV. Related Vulnerabilities
Same vendor: Red Hat
-
CVE-2026-104988
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentic -
CVE-2026-95512
Freetype: freetype: denial of service via repeated subroutin -
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50
Same weakness: CWE-22
-
CVE-2026-87115
VikAppointments Services Booking Calendar <= 1.2.21 - Unauth -
CVE-2026-104478
Formwork before 2.3.13 Path Traversal via BackupController D -
CVE-2026-104871
Angular SSR: Path Traversal to Sibling Directories in Common -
CVE-2014-125130
CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read v -
CVE-2026-104853
Nx: Path traversal in nx migrate package-migrations extracti
V. Comments for CVE-2026-6855
No comments yet