Logback: Incomplete protection against CVE-2026-19880
Summary
| CVE | CVE-2026-104721 |
|---|---|
| State | PUBLISHED |
| Assigner | NCSC.ch |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-02 14:17:10 UTC |
| Updated | 2026-10-02 14:17:10 UTC |
| Description | Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques. |
Risk And Classification
Primary CVSS: v4.0 6.3 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green
Problem Types: CWE-22 | CWE-22 CWE-22
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/A... |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | QOS.CH Sarl | Logback-classic | affected 0.9.14 1.6.4 maven | Java |
| CNA | QOS.CH Sarl | Logback-classic | unaffected 1.6.5 maven | Java |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| logback.qos.ch/news.html | [email protected] | logback.qos.ch | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: François Martin (GitHub: @martinfrancois, https://github.com/martinfrancois) (en)
Additional Advisory Data
Solutions
CNA: Update to logack version 1.6.5 or later. This vulnerability requires SiftingAppender to be active as well as unsanitized data provided by an attacker that MDCDiscriminator makes use of. Sanitizing relevant data provided by the user should fix this vulnerability.
Workarounds
CNA: Update to logack version 1.6.5 or later. This vulnerability requires SiftingAppender to be active as well as unsanitized data provided by an attacker that MDCDiscriminator makes use of.
Exploits
CNA: No known exploitation