Threats affecting pkg:maven/ch.qos.logback/logback-classic

CVE-2026-104721 is a path-traversal vulnerability in the Logback-classic module by QOS.CH Sarl. It arises when an MDC-based discriminator value is used unsanitized in a nested FileAppender path, allowing an attacker who can influence the MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This affects Logback-classic versions from 0.9.14 through 1.6.4. The vulnerability is similar to CVE-2026-19880 but involves different attack techniques.

CVE-2026-19880 is a path traversal vulnerability in QOS.CH Sarl Logback-classic (logback-classic module) affecting versions from 0.9.14 through 1.6.2. The issue arises because an MDC-based discriminator value is not sanitized before being used in a nested FileAppender path, allowing an attacker who can influence this MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This vulnerability has a medium severity rating with a CVSS score of 6.3.