A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` parameter. This allows the attacker to create new directories and write files to arbitrary locations on the system, potentially leading to unauthorized data modification or disclosure.
| Vendor | Product | Versions |
|---|---|---|
| red hat | red hat enterprise linux ai (rhel ai) | — |
Updated severity to CRITICAL and marked the vulnerability as actively exploited.
Initial creation
