CVE-2026-19880 PUBLISHED

Incomplete protection against CVE-2025-11226

Assigner: NCSC.ch
Reserved: 14.08.2026 Published: 14.08.2026 Updated: 14.08.2026

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.2.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green
CVSS Score: 6.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	Present	Availability	Low	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	QOS.CH Sarl
Product	Logback-classic
Versions	Default: affected affected from 0.9.14 to 1.6.2 (incl.) Version 1.6.3 is unaffected

Exploits

No known exploitation

Workarounds

Update to logack version 1.6.3 or later. This vulnerability requires SiftingAppender to be active as well as unsanitized data provided by an attacker that MDCDiscriminator makes use of.

Solutions

Update to logack version 1.6.3 or later. This vulnerability requires SiftingAppender to be active as well as unsanitized data provided by an attacker that MDCDiscriminator makes use of.

Sanitizing relevant data provided by the user should fix this vulnerability.

Credits

York Shen - Yong Shen - PayPal Cyber Security Team (UID 100171) finder

References

https://logback.qos.ch/news.html#1.6.3

Problem Types

CWE-22 CWE

Impacts

path-traversal vulnerability