CVE-2026-6855

CVE-2026-6855 is a path traversal vulnerability in InstructLab's chat session handler that allows local attackers to manipulate the logs_dir parameter to create directories and write files to arbitrary system locations, potentially leading to unauthorized data modification or disclosure. The vulnerability carries a CVSS score of 7.1 (HIGH) with a local attack vector, low complexity, and low privilege requirements, resulting in high confidentiality and integrity impacts. While the EPSS score of 0.00015 indicates minimal current exploitation probability relative to the broader CVE landscape, the vulnerability is not currently tracked on the Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation in the wild. The moderate FAUCET risk score of 46.0 suggests some concern, though community attention remains limited at this time. Organizations running InstructLab should prioritize patching this vulnerability to prevent potential unauthorized file system access and data compromise.