CVE-2026-104721

MediumCVSS 6.3

Published: 02/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Summary

A path-traversal vulnerability in the logback-classic module (Java) allows writing log files outside the intended directory when an MDC-based discriminator value (e.g., from an HTTP header) flows unsanitized into a nested FileAppender path. Affects versions from 0.9.14 through 1.6.4.

Risk Assessment

An attacker can influence the location of log files, potentially leading to writing data to unauthorized locations, which could enable privilege escalation or modification of critical files.

Recommendation

It is recommended to upgrade logback-classic to a version newer than 1.6.4 and to validate and sanitize MDC values before using them in file paths.

Other vulnerabilities in Logback-classic

CVE-2026-19880Medium
A path-traversal vulnerability in the logback-classic module (Java) by QOS.CH Sarl. An MDC-based discriminator value flows unsanitized into a nested FileAppender path, allowing an attacker who influences that MDC value (e.g., via an HTTP header) to create and append log files outside the intended directory. Affects versions from 0.9.14 through 1.6.2.

Original NVD description (English source)

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS