CVE-2026-19880
Incomplete protection against CVE-2025-11226
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Incomplete protection against CVE-2025-11226
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
- Record
CVE-2026-19880- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-58667
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
- Record
EUVD-2026-58667- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9mh8-hq67-v26g
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module)...
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
- Record
GHSA-9mh8-hq67-v26g- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
- Record
CVE-2026-19880- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.
- Record
DEBIAN-CVE-2026-19880- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-02
OSVOESA-2026-4014
logback security update
Logback is intended as a successor to the popular log4j project.
Security Fix(es):
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.(CVE-2026-19880)
- Record
OESA-2026-4014- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-02
Show 6 moreShow less
OSVRHLW-2026-07e5370d09e5a6f8
Lightwell Security Advisory: logback-core 1.5.9.rhlw-00031
Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880.
CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.
A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
CVE-2024-12801: Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects
CVE-2026-19880: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.9 from Maven Central.
- Record
RHLW-2026-07e5370d09e5a6f8- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Clear - Updated
- 2026-11-02
OSVRHLW-2026-4f8afe0cda7c5f03
Lightwell Security Advisory: logback-classic 1.5.16.rhlw-00003
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.16.rhlw-00003 with backported fixes for CVE-2026-104721 and CVE-2026-19880.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
CVE-2026-19880: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.16 from Maven Central.
- Record
RHLW-2026-4f8afe0cda7c5f03- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-06
OSVRHLW-2026-9cab5871d815dd9d
Lightwell Security Advisory: logback-classic 1.5.9.rhlw-00031
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880.
CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.
A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
CVE-2024-12801: Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects
CVE-2026-19880: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.9 from Maven Central.
- Record
RHLW-2026-9cab5871d815dd9d- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Clear - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.
- Record
UBUNTU-CVE-2026-19880- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11965-1 No score
logback-1.6.5-1.1 on GA media
These are all security issues fixed in the logback-1.6.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11965-1- Updated
- 2026-11-02
OSVRHLW-2026-21709a248f2eeb7d No score
Lightwell Security Advisory: logback-classic 1.6.1.rhlw-00001
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.6.1.rhlw-00001 with a backported security fix.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.6.1 from Maven Central.
- Record
RHLW-2026-21709a248f2eeb7d- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
logbackDebian:12 |
All versions, plus listed versions 1:1.2.11-31:1.2.11-41:1.2.11-51:1.2.11-61:1.6.3-11:1.6.3-2 |
None known |
logbackDebian:13 |
All versions, plus listed versions 1:1.2.11-61:1.6.3-11:1.6.3-2 |
None known |
logbackDebian:14 |
before 1:1.6.3-1, plus listed versions 1:1.2.11-6 |
1:1.6.3-1 |
logbackopenEuler:24.03-LTS-SP4 |
before 1.2.8-5.oe2403sp4 | 1.2.8-5.oe2403sp4 |
logbackopenEuler:20.03-LTS-SP4 |
before 1.2.8-5.oe2003sp4 | 1.2.8-5.oe2003sp4 |
logbackopenEuler:22.03-LTS-SP4 |
before 1.2.8-5.oe2203sp4 | 1.2.8-5.oe2203sp4 |
logbackopenEuler:24.03-LTS-SP1 |
before 1.2.8-5.oe2403sp1 | 1.2.8-5.oe2403sp1 |
logbackopenEuler:24.03-LTS-SP3 |
before 1.2.8-5.oe2403sp3 | 1.2.8-5.oe2403sp3 |
ch.qos.logback:logback-coreRed Hat Lightwell:Maven From an advisory covering 4 CVEs |
before 1.5.9.rhlw-00031, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.5.9.rhlw-00031 |
ch.qos.logback:logback-classicRed Hat Lightwell:Maven |
before 1.6.1.rhlw-00001, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.6.1.rhlw-00001 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ch.qos.logback:logback-classicRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 1.5.16.rhlw-00003, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.5.16.rhlw-00003 |
ch.qos.logback:logback-classicRed Hat Lightwell:Maven From an advisory covering 4 CVEs |
before 1.5.9.rhlw-00031, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.5.9.rhlw-00031 |
logbackUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.1.3-21:1.1.3-2ubuntu0.1~esm1 |
None known |
logbackUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:1.1.9-41:1.1.9-51:1.2.3-21:1.2.3-2ubuntu1~18.04.11:1.2.3-2ubuntu1~18.04.1+esm1 |
None known |
logbackUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.2.3-51:1.2.3-5ubuntu0.1~esm1 |
None known |
logbackUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.2.3-61:1.2.7-11:1.2.8-11:1.2.9-11:1.2.10-11:1.2.10-1ubuntu0.1~esm1 |
None known |
logbackUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.2.11-31:1.2.11-41:1.2.11-5 |
None known |
logbackUbuntu:26.10 |
All versions, plus listed versions 1:1.2.11-6build1 |
None known |
logbackUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.2.11-61:1.2.11-6build1 |
None known |
logbackopenSUSE:Tumbleweed |
before 1.6.5-1.1 | 1.6.5-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19880 is a medium vulnerability (CVSS 6.3) in Qos.ch Sarl Logback-classic, published August 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in logback 1:1.6.3-1.
References
logback.qos.ch/news.html
nvd.nist.gov/vuln/detail/CVE-2026-19880
github.com/advisories/GHSA-9mh8-hq67-v26g
security-tracker.debian.org/tracker/CVE-2026-19880
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4014
Show 11 moreShow less
ubuntu.com/security/CVE-2026-19880
cve.org/CVERecord?id=CVE-2026-19880
suse.com/security/cve/CVE-2026-19880
Left out here: 398 versions. The JSON record has them.