GHSA-pqmg-c2j8-fq92HighCVSS 7.1

InstructLab vulnerable to Path Traversal

Published
April 22, 2026
Last Modified
April 29, 2026

🔗 CVE IDs covered (1)

📋 Description

A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the logs_dir parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.

🎯 Affected products1

  • pip/instructlab:<= 0.26.1

🔗 References (4)