Logback-classic EUVD-2026-91633

Exploitation requires that the target application is configured so a FileAppender (typically within a SiftingAppender) builds its output file path from an MDC discriminator value, and that this MDC value is populated from attacker-influenced input such as an HTTP header - this is an application-specific, non-default logging configuration. The attacker must be able to set or influence that MDC/header value and the traversal sequence must survive into the resolved file path. Limiting factors: no special conditions are needed on the network side (remote, no authentication indicated by PR:N, no user interaction), but the AT:P requirement means the flaw is inert unless the specific MDC-to-file-path configuration is present; impact is confined to file creation/append outside the directory (integrity/availability), not read access or code execution.

This is a medium-severity path-traversal flaw (CWE-22) in Logback-classic, scored 6.3 by the reporter using CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N with Low confidentiality, integrity and availability impact and no scope change to subsequent systems). The signals are internally consistent and point to a conditional, bounded issue rather than a top-priority emergency: the AT:P ('attack requirement present') metric and the description both make clear exploitation only works when the application is deliberately configured so that an MDC-based discriminator value feeds a nested FileAppender path - this is NOT a default configuration. There is no public exploit identified at time of analysis and no KEV listing, and EPSS was not provided in the input, so exploitation probability cannot be quantified. The impact is limited to creating and appending log files outside the intended directory (file write / integrity and availability pressure), not arbitrary code execution or data disclosure, which keeps real-world risk moderate. Note a tension to verify: the CVSS 4.0 vector asserts Low confidentiality impact (VC:L), but the described primitive is write/append-only (log file creation outside the directory) with no obvious read path - the confidentiality impact appears overstated and should be confirmed with the vendor advisory.

A Java web application uses Logback with a SiftingAppender whose discriminator is populated from an MDC value derived from an attacker-controllable HTTP header, and that value is interpolated into a FileAppender file path. The attacker sends a request with a crafted header containing traversal sequences (e.g. '../../'), causing Logback to create and append a log file outside the intended log directory. No public exploit code was identified at time of analysis, so weaponization would require custom tooling against a specifically-configured target.