Threats tagged 'ghsa-5f86-rhcp-cxm6'

CVE-2026-104721 is a path-traversal vulnerability in the Logback-classic module by QOS.CH Sarl. It arises when an MDC-based discriminator value is used unsanitized in a nested FileAppender path, allowing an attacker who can influence the MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This affects Logback-classic versions from 0.9.14 through 1.6.4. The vulnerability is similar to CVE-2026-19880 but involves different attack techniques.