Bug 2545184 (CVE-2026-104721)

Summary:	CVE-2026-104721 ch.qos.logback/logback-classic: logback-classic: Arbitrary file write via path traversal in MDC discriminator
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abrianik, amctagga, anthomas, aoconnor, bniver, csutherl, dhanak, drosa, dsimansk, dsoumis, ehelms, flucifre, ggainey, ggrzybek, gmalinko, gmeno, groman, gtanzill, janstey, jbuscemi, jclere, jpasqual, jraez, juwatts, jwon, kingland, mbenjamin, mdellweg, mhackett, mhulan, mnovotny, nmoumoul, osousa, parichar, pcreech, pdelbell, pjindal, plodge, rchan, rhel-process-autobot, rjohnson, rmaucher, rstepani, sausingh, sdawley, smallamp, sostapov, szappis, tasato, tmalecek, vereddy, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in logback-classic. This path traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. The issue occurs when an unsanitized Mapped Diagnostic Context (MDC) discriminator value flows into a nested log file path, enabling an attacker who can influence this context, such as through an HTTP request header, to manipulate the destination file location.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-02 13:33:16 UTC

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an 
MDC-based discriminator value flows unsanitized into a nested 
FileAppender path, letting an attacker who influences that MDC value 
(e.g. via an HTTP header)
 create and append log files outside the intended directory. 


This issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.