Medium 6.3Published Oct 2, 2026

CVE-2026-104721Logback: Incomplete protection against CVE-2026-19880

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects QOS.CH Sarl Logback-classic. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for QOS.CH Sarl Logback-classic

Exploited in the last 30 days

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.

CVSS: 6.3 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: NCSC.ch
NVD analysis: Deferred
Record last updated: Oct 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

QOS.CH Sarl Logback-classic qos.ch_sarl:logback_classic (from the name)	from 0.9.14 through 1.6.4; 1.6.5 not affected	CNA record

References

https://logback.qos.ch/news.html#1.6.5

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.