EUVD-2026-24736
GHSA-pqmg-c2j8-fq92
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the logs_dir parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
AnalysisAI
Path traversal in InstructLab's chat session handler enables local authenticated attackers to write files to arbitrary filesystem locations by manipulating the logs_dir parameter. Red Hat Enterprise Linux AI 3 deployments are confirmed affected. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: inventory all Red Hat Enterprise Linux AI 3 deployments running InstructLab and document current versions. Within 7 days: implement strict local access controls and file system permissions to limit who can interact with InstructLab chat session handlers; isolate affected systems from sensitive data locations. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today