CVE-2026-104721
Logback: Incomplete protection against CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Logback: Incomplete protection against CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
- Record
CVE-2026-104721- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-91633
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
- Record
EUVD-2026-91633- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5f86-rhcp-cxm6
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module)...
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
- Record
GHSA-5f86-rhcp-cxm6- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
- Record
CVE-2026-104721- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-104721
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
- Record
DEBIAN-CVE-2026-104721- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-02
OSVRHLW-2026-0cbc88c2ff3f926a
Lightwell Security Advisory: logback-classic 1.5.18.rhlw-00006
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.18.rhlw-00006 with a backported security fix.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.18 from Maven Central.
- Record
RHLW-2026-0cbc88c2ff3f926a- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-06
Show 6 moreShow less
OSVRHLW-2026-196ac03ad2d3efd8
Lightwell Security Advisory: logback-classic 1.5.13.rhlw-00004
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.13.rhlw-00004 with a backported security fix.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.13 from Maven Central.
- Record
RHLW-2026-196ac03ad2d3efd8- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-06
OSVRHLW-2026-2e3c2491325e3672
Lightwell Security Advisory: logback-classic 1.6.1.rhlw-00003
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.6.1.rhlw-00003 with a backported security fix.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.6.1 from Maven Central.
- Record
RHLW-2026-2e3c2491325e3672- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-06
OSVRHLW-2026-4f8afe0cda7c5f03
Lightwell Security Advisory: logback-classic 1.5.16.rhlw-00003
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.16.rhlw-00003 with backported fixes for CVE-2026-104721 and CVE-2026-19880.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
CVE-2026-19880: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.16 from Maven Central.
- Record
RHLW-2026-4f8afe0cda7c5f03- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-06
OSVRHLW-2026-b7f60b9979a4b5a4
Lightwell Security Advisory: logback-classic 1.5.38.rhlw-00006
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.38.rhlw-00006 with a backported security fix.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.38 from Maven Central.
- Record
RHLW-2026-b7f60b9979a4b5a4- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-104721
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
- Record
UBUNTU-CVE-2026-104721- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11985-1 No score
logback-1.6.5-2.1 on GA media
These are all security issues fixed in the logback-1.6.5-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11985-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
logbackDebian:12 |
All versions, plus listed versions 1:1.2.11-31:1.2.11-41:1.2.11-51:1.2.11-61:1.6.3-11:1.6.3-2 |
None known |
logbackDebian:13 |
All versions, plus listed versions 1:1.2.11-61:1.6.3-11:1.6.3-2 |
None known |
logbackDebian:14 |
All versions, plus listed versions 1:1.2.11-61:1.6.3-11:1.6.3-2 |
None known |
ch.qos.logback:logback-classicRed Hat Lightwell:Maven |
before 1.5.18.rhlw-00006, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.5.18.rhlw-00006 |
ch.qos.logback:logback-classicRed Hat Lightwell:Maven |
before 1.5.13.rhlw-00004, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.5.13.rhlw-00004 |
ch.qos.logback:logback-classicRed Hat Lightwell:Maven |
before 1.6.1.rhlw-00003, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.6.1.rhlw-00003 |
ch.qos.logback:logback-classicRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 1.5.16.rhlw-00003, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.5.16.rhlw-00003 |
ch.qos.logback:logback-classicRed Hat Lightwell:Maven |
before 1.5.38.rhlw-00006, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.5.38.rhlw-00006 |
logbackUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.1.3-21:1.1.3-2ubuntu0.1~esm1 |
None known |
logbackUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:1.1.9-41:1.1.9-51:1.2.3-21:1.2.3-2ubuntu1~18.04.11:1.2.3-2ubuntu1~18.04.1+esm1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
logbackUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.2.3-51:1.2.3-5ubuntu0.1~esm1 |
None known |
logbackUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.2.3-61:1.2.7-11:1.2.8-11:1.2.9-11:1.2.10-11:1.2.10-1ubuntu0.1~esm1 |
None known |
logbackUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.2.11-31:1.2.11-41:1.2.11-5 |
None known |
logbackUbuntu:26.10 |
All versions, plus listed versions 1:1.2.11-6build1 |
None known |
logbackUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.2.11-61:1.2.11-6build1 |
None known |
logbackopenSUSE:Tumbleweed |
before 1.6.5-2.1 | 1.6.5-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-104721 is a medium vulnerability (CVSS 6.3) in Qos.ch Sarl Logback-classic, published October 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in ch.qos.logback:logback-classic 1.5.18.rhlw-00006.
References
logback.qos.ch/news.html
nvd.nist.gov/vuln/detail/CVE-2026-104721
github.com/advisories/GHSA-5f86-rhcp-cxm6
security-tracker.debian.org/tracker/CVE-2026-104721
ubuntu.com/security/CVE-2026-104721
cve.org/CVERecord?id=CVE-2026-104721
suse.com/security/cve/CVE-2026-104721
Left out here: 530 versions. The JSON record has them.