CVE-2026-19880: qos.ch sarl logback-classic Path Traversal

Vulnerability summary

CVE-2026-19880 is a medium (CVSS 6.3) Path Traversal vulnerability in qos.ch sarl logback-classic. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.9% of scored vulnerabilities.

Timeline

1. 14-08-2026
   PublishedVulnerability first disclosed.
2. 14-08-2026
   Last modifiedVulnerability information updated.

Description

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.