CVE-2026-104721 is a path-traversal vulnerability in the Logback-classic module by QOS.CH Sarl. It arises when an MDC-based discriminator value is used unsanitized in a nested FileAppender path, allowing an attacker who can influence the MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This affects Logback-classic versions from 0.9.14 through 1.6.4. The vulnerability is similar to CVE-2026-19880 but involves different attack techniques.
CVE-2026-19880 is a path traversal vulnerability in QOS.CH Sarl Logback-classic (logback-classic module) affecting versions from 0.9.14 through 1.6.2. The issue arises because an MDC-based discriminator value is not sanitized before being used in a nested FileAppender path, allowing an attacker who can influence this MDC value (for example, via an HTTP header) to create or append log files outside the intended directory. This vulnerability has a medium severity rating with a CVSS score of 6.3.
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a
configuration file. Alternatively, the attacker could inject a malicious
environment variable pointing to a malicious configuration file. In both
cases, the attack requires existing privilege.
Please note that in logack version 1.5.37 conditional processing using Janino was removed.
CVE-2026-10532 is a deserialization of untrusted data vulnerability in the logback-core component of QOS.CH Sarl's logback library, specifically in the HardenedObjectInputStream module. It allows an attacker who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer to instantiate Proxy objects, bypassing intended security restrictions. The vulnerability affects logback versions from 0 up to and including 1.5.33. No practical remote code execution or significant privilege escalation has been identified. The severity is rated low with a CVSS score of 2.9.
CVE-2026-9828 is a low-severity deserialization vulnerability in QOS.CH Sarl's logback-core module affecting versions prior to 1.5.33. It involves the HardenedObjectInputStream component, where an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate certain java.lang and java.util objects that are not explicitly blocked. Despite this, the deserialization restrictions are strong, and no practical remote code execution or significant privilege escalation has been identified.
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.
The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a
configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a
configuration file. Alternatively, the attacker could inject a malicious
environment variable pointing to a malicious configuration file. In both
cases, the attack requires existing privilege.