Path Traversal Vulnerability in Logback-classic by QOS.CH Sarl
CVE-2026-104721

6.3MEDIUM

Key Information:

Vendor

Qos.ch Sarl

Status
Logback-classic
Vendor
CVE Published:
2 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-104721?

A path-traversal vulnerability in Logback-classic allows an attacker to manipulate a nested FileAppender path by influencing an unsanitized MDC-based discriminator value. This could lead to unauthorized creation and modification of log files outside the designated directory, posing risks to data integrity and security. This issue is particularly problematic during interactions via HTTP headers, enabling potential exploitation.

Affected Version(s)

Logback-classic Java 0.9.14 <= 1.6.4

Logback-classic Java 0.9.14 <= 1.6.4

Logback-classic Java 1.6.5

References

https://logback.qos.ch/news.html#1.6.5

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

François Martin (GitHub: @martinfrancois, https://github.com/martinfrancois)
.