Logback-classic, a Java logging framework intended as a successor to log4j, contains a path traversal vulnerability (CWE-22) in its handling of MDC-based discriminator values used in nested FileAppender paths. Unsanitized input from the MDC can be manipulated by an attacker to write log files outside the designated directory, potentially leading to unauthorized file creation or modification. This affects versions >=0.9.14 and <=1.6.2 of Logback-classic.

An attacker capable of influencing the MDC discriminator value (for example, via an HTTP header) can exploit this vulnerability to create or append log files outside the intended logging directory. This may lead to unauthorized file writes, potentially impacting system integrity or confidentiality depending on the environment and log file usage. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider sanitizing MDC discriminator inputs or restricting log file path permissions to mitigate potential exploitation.