PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6855 Red Hat CVE debrief

CVE-2026-6855 is a high-severity path traversal issue in InstructLab’s chat session handler. By manipulating the `logs_dir` parameter, a local attacker with low privileges can cause the application to create directories or write files outside the intended location, which can lead to unauthorized data modification or disclosure.

Vendor
Red Hat
Product
Red Hat Enterprise Linux AI (RHEL AI) 3
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-05-20
Advisory published
2026-04-22
Advisory updated
2026-05-20

Who should care

Administrators and security teams running InstructLab or Red Hat Enterprise Linux AI 3.0 should prioritize this issue, especially on systems where local users or service accounts may interact with chat session handling or log paths.

Technical summary

NVD classifies the issue as CWE-22 (path traversal) with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. The supplied description indicates the vulnerable chat session handler accepts a controllable `logs_dir` value, allowing arbitrary directory creation and file writes at attacker-chosen locations on affected InstructLab deployments.

Defensive priority

High. Because the attack is local and requires only low privileges, any shared or multi-user deployment should be reviewed promptly. Focus on reducing local access, validating or constraining log path inputs, and applying vendor remediation as soon as it is available.

Recommended defensive actions

  • Review the Red Hat advisory for CVE-2026-6855 and apply the vendor fix or workaround once confirmed.
  • Restrict local shell and service-account access on affected hosts to reduce exposure to low-privilege attackers.
  • Validate or harden any code or configuration that allows `logs_dir` to be set by users or untrusted inputs.
  • Monitor for unexpected directory creation or file writes in application and log storage paths.
  • Check affected InstructLab and Red Hat Enterprise Linux AI 3.0 systems for exposure to this issue and prioritize patching.

Evidence notes

The supplied NVD record describes CVE-2026-6855 as a local path traversal flaw in InstructLab, with CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N and CWE-22. The Red Hat advisory and linked Bugzilla entry are the only official vendor references provided in the corpus, and they should be used for remediation and product-specific status details.

Official resources

Published by NVD and the CVE record on 2026-04-22, with a later NVD modification on 2026-05-20. Timing in this debrief follows the supplied CVE published date, not generation time.