CVE-2026-19880
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A path-traversal vulnerability in the logback-classic module (Java) by QOS.CH Sarl. An MDC-based discriminator value flows unsanitized into a nested FileAppender path, allowing an attacker who influences that MDC value (e.g., via an HTTP header) to create and append log files outside the intended directory. Affects versions from 0.9.14 through 1.6.2.
Risk Assessment
The risk includes the ability to write files to arbitrary locations, potentially leading to overwriting important files or privilege escalation.
Recommendation
Update logback-classic to version 1.6.3 or later and sanitize MDC values before using them in file paths.
Original NVD description (English source)
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.