The vulnerability in Logback-classic (CVE-2026-19880) is a path traversal issue (CWE-22) where an unsanitized MDC discriminator value flows into a nested FileAppender path. This enables an attacker who can control the MDC value to write log files outside the designated directory, potentially leading to unauthorized file creation or modification. The affected versions are from 0.9.14 through 1.6.2. No official remediation or patch is currently documented, and no known exploits are reported in the wild.

An attacker able to influence the MDC discriminator value can cause the application to write log files outside the intended directory. This may lead to unauthorized file creation or modification, potentially impacting system integrity or confidentiality depending on the environment and log file usage. The CVSS score of 6.3 reflects a medium severity impact with network attack vector and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider sanitizing MDC discriminator values before they are used in file paths or restrict the application’s file system permissions to limit the impact of unauthorized file writes.