Logback-classic EUVD-2026-58667

Q: What is the CVSS score of EUVD-2026-58667?

EUVD-2026-58667 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green. EPSS exploitation probability: 0.3%.

| CVE-2026-19880 MEDIUM

Path Traversal (CWE-22)

2026-08-14 NCSC.ch

GHSA-9mh8-hq67-v26g

Java Path Traversal Red Hat Logback Classic Qos Ch Sarl

6.3

CVSS 4.0 · Vendor: NCSC.ch

Severity by source

Vendor (NCSC.ch) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green

vuln.today AI

5.6 MEDIUM

AC:H reflects the prerequisite MDC-discriminator configuration; PR:N and AV:N because HTTP reachability requires no credentials; limited CIA impact from file write outside intended directory.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (NCSC.ch).

CVSS VectorVendor: NCSC.ch

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 15:01 vuln.today

CVE Published

Aug 14, 2026 - 14:31 cve.org

MEDIUM 6.3

DescriptionCVE.org

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.2.

AnalysisAI

Path traversal in Logback-classic versions 0.9.14 through 1.6.2 enables a remote unauthenticated attacker to create and append log files at arbitrary filesystem locations by injecting traversal sequences into an MDC (Mapped Diagnostic Context) value that flows unsanitized into a nested FileAppender path. Deployments using MDC-based discriminators - a pattern frequently triggered by HTTP header values automatically stored in MDC by web frameworks - are directly at risk. No public exploit code or active exploitation has been confirmed at time of analysis; vendor fix notes reference version 1.6.3 as the remediated release.

Technical ContextAI

Logback-classic (CPE: cpe:2.3:a:qos.ch_sarl:logback-classic) is the dominant Java logging framework, widely used as the native backend for SLF4J in Spring Boot and enterprise Java ecosystems. The SiftingAppender component supports MDC-based discriminators that dynamically route log output to separately named FileAppender instances, with the discriminator value composing part of the output file path. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the MDC value is passed directly into the nested FileAppender path constructor without stripping path separators or traversal sequences such as '../'. Because many Java servlet frameworks - Spring MVC, JAX-RS interceptors, and MDC propagation filters - automatically populate MDC with HTTP request metadata such as header values, request IDs, or tenant identifiers, external network actors can influence the discriminator value through ordinary HTTP interaction, causing Logback to open or append file handles outside the configured log directory at whatever filesystem paths the JVM process has write access to.

RemediationAI

Upgrade logback-classic to version 1.6.3 or later, per QOS.CH Sarl release notes at https://logback.qos.ch/news.html#1.6.3; this is the primary and recommended fix. If an immediate dependency upgrade is not feasible, the most effective compensating control is to audit all SiftingAppender and MDC-based discriminator configurations and replace any discriminator keys populated from attacker-influenced sources (HTTP headers, query parameters) with either static values or allowlist-validated strings - this eliminates the attacker-controlled input at the configuration level but requires a code or logback.xml change and may affect log file routing behavior in multi-tenant configurations. As a secondary defense, restrict the JVM process's filesystem write permissions via OS-level controls (dedicated low-privilege service account, seccomp profile, or container read-only filesystem with explicit volume mounts limited to /var/log/appname) to contain the blast radius of a successful traversal without altering application behavior. WAF-based input filtering targeting '../' sequences is an unreliable control due to encoding variations and should not be relied upon as a primary mitigation.