Threats tagged 'ghsa-9mh8-hq67-v26g'

CVE-2026-19880 is a path traversal vulnerability in QOS.CH Sarl Logback-classic (logback-classic module) affecting versions from 0.9.14 through 1.6.2. The issue arises because an MDC-based discriminator value is not sanitized before being used in a nested FileAppender path, allowing an attacker who can influence this MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This vulnerability has a medium severity rating with a CVSS score of 6.3.