CVE-2026-19880
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability.
Published Aug 14, 2026 · updated Oct 15, 2026
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Aug 14, 2026 · OSV.dev
Detected
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-clas
Oct 15, 2026 · OSV.dev
Fix available
logback fixed in 1:1.6.3-1
Oct 15, 2026 · OSV.dev
Fix available
logback fixed in 1:1.6.3-1
Oct 15, 2026 · OSV.dev
Updated
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-clas
Affected
- Debian:12 logback1:1.2.11-3, 1:1.2.11-4, 1:1.2.11-5
- Debian:13 logback1:1.2.11-6, 1:1.6.3-1, 1:1.6.3-2
- Debian:14 logback0 → 1:1.6.3-1