CVE-2026-19880
Received Received - Intake

Path Traversal in Logback-classic Java Library

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Switzerland Government Common Vulnerability Program

Description
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19880
EUVD
EUVD-2026-58667

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qos_ch_sarl logback_classic From 0.9.14 (inc) to 1.6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path-traversal vulnerability in QOS.CH Sarl Logback-classic for Java. It allows an attacker to influence an MDC-based discriminator value, which then flows unsanitized into a nested FileAppender path. This lets the attacker create and append log files outside the intended directory by manipulating values like HTTP headers.

Impact Analysis

An attacker could write malicious log files to arbitrary locations on the system. This might lead to denial of service, execution of arbitrary code if logs are processed by other systems, or disclosure of sensitive information stored in logs.

Compliance Impact

This vulnerability could violate compliance by allowing unauthorized file writes, potentially leading to data integrity issues or unauthorized access to sensitive data. It may breach GDPR's integrity principle or HIPAA's integrity and availability requirements if logs containing protected health information are compromised.

Mitigation Strategies

Upgrade Logback-classic to a version outside the affected range (0.9.14 through 1.6.2). Specifically, install version 1.6.3 or later to address the path-traversal issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart