Arbitrary file writes via unsanitized log path

Path traversal in the InstructLab chat session handler in Red Hat Enterprise Linux AI 3 allows local users to write arbitrary files. The handler passes the attacker-controlled logs_dir value directly to os.makedirs and uses it to construct log-file paths without validating that the resolved path stays inside the intended directory. Low-privileged local access is required; exploitation can create directories and overwrite accessible files, causing unauthorized modification or disclosure.