CVE-2026-6855
Published: 22 April 2026
Summary
CVE-2026-6855 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates path traversal by validating the logs_dir parameter against directory traversal sequences before processing file operations.
Requires timely patching and flaw remediation for the specific vulnerability in InstructLab's chat session handler as detailed in the Red Hat advisory.
Enforces access control policies to restrict unauthorized file writes to arbitrary system locations by low-privilege local attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables arbitrary file writes to any location, directly facilitating stored data manipulation via overwrites and indirect privilege escalation by targeting critical system files.
NVD Description
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on…
more
the system, potentially leading to unauthorized data modification or disclosure.
Deeper analysisAI
CVE-2026-6855, published on 2026-04-22, is a path traversal vulnerability (CWE-22) in InstructLab's chat session handler. The flaw allows manipulation of the `logs_dir` parameter, enabling attackers to create new directories and write files to arbitrary locations on the system. This affects InstructLab deployments and has a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), rated as high severity due to its potential for unauthorized data modification or disclosure.
A local attacker with low privileges can exploit this vulnerability with low complexity and no user interaction required. By crafting malicious requests to the chat session handler, the attacker gains the ability to write files outside intended directories, potentially overwriting critical system files, escalating privileges indirectly, or exfiltrating sensitive data through controlled file placements.
Mitigation details are available in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-6855 and the associated Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2460013, which likely include patch information and workarounds for affected InstructLab versions.
Details
- CWE(s)