CVE-2026-19880

A flaw was found in Logback-classic. This path-traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. This occurs because an unsanitized discriminator value, influenced by the attacker (for example, via an HTTP header), is used in a file path within the logging mechanism.

This vulnerability is rated as having a Moderate impact because successful exploitation requires non-default logging configurations where dynamic discriminators incorporate untrusted request data directly into target file destinations. In typical Red Hat deployments, logging frameworks write to predefined, static system log directories, significantly limiting an external attacker's ability to manipulate file paths. Furthermore, the flaw is restricted to creating or appending application log entries outside expected directories and does not permit arbitrary code execution or file disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.