CVE-2026-19880CWE-22path-traversal

CVE-2026-19880

published August 14, 2026

CVSS
6.3
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an

MDC-based discriminator value flows unsanitized into a nested

FileAppender path, letting an attacker who influences that MDC value

(e.g. via an HTTP header)

create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.2.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green
EPSS
0.00332 · 25.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-14T19:17Z
References (1)
https://logback.qos.ch/news.html#1.6.3 · [email protected]
EPSS history
Timeline
  • 14 AUG 14:31Z
    Incomplete protection against CVE-2025-11226
    cvelistv5