The vulnerability in Logback-classic involves improper sanitization of MDC-based discriminator values that are used in file paths for logging. An attacker controlling the MDC value can exploit this to perform path traversal, enabling creation or modification of log files outside the designated directory. This affects versions >=0.9.14 and <=1.6.4 of Logback-classic. The CVSS 4.0 score is 6.3, indicating a medium severity issue. No official patch or remediation details are provided in the input data.

An attacker able to influence the MDC discriminator value can cause the logging system to write files outside the intended directory, potentially leading to unauthorized file creation or modification. This could be leveraged to manipulate log files or possibly escalate attacks depending on the environment. The vulnerability does not require privileges or user interaction but does require the ability to influence MDC values, such as via HTTP headers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting or sanitizing MDC discriminator values before they are used in file paths. Monitoring and controlling inputs that influence MDC values, especially from untrusted sources like HTTP headers, can reduce risk.