CVE-2026-104721
Public on 2026-10-02
Modified on 2026-10-03
Description
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an
MDC-based discriminator value flows unsanitized into a nested
FileAppender path, letting an attacker who influences that MDC value
(e.g. via an HTTP header)
create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
MDC-based discriminator value flows unsanitized into a nested
FileAppender path, letting an attacker who influences that MDC value
(e.g. via an HTTP header)
create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2023 | texlive-base | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L |