CVE-2026-104721: Logback-classic path-traversal in MDC-based discriminator

CVE-2026-104721 · Severity: info · Published 2026-10-02

Logback-classic is a Java logging library that formats and writes application logs to files and other destinations. An attacker who can influence HTTP headers or other MDC values can craft malicious input that creates log files outside the intended directory, potentially writing to sensitive filesystem locations or enabling further attacks.

Vendors: QOS.CH Sarl.

Quick answers

Is CVE-2026-104721 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-104721 being exploited in the wild.
How severe is CVE-2026-104721?
Informational severity, published 2 October 2026.
Which products and versions are affected?
QOS.CH Sarl Logback-classic 0.9.14 through 1.6.4.
Is there a fix for CVE-2026-104721?
Yes: fixed in Logback-classic 1.6.5. Until then: Restrict or validate HTTP headers and other sources of MDC values to prevent untrusted data from reaching the discriminator; alternatively, avoid using SiftingAppender with MDCBasedDiscriminator until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104721 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-104721?
Check whether you run QOS.CH Sarl Logback-classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Logback-classic 1.6.5

Restrict or validate HTTP headers and other sources of MDC values to prevent untrusted data from reaching the discriminator; alternatively, avoid using SiftingAppender with MDCBasedDiscriminator until upgrading.

Technical details

The MDCBasedDiscriminator component in SiftingAppender fails to properly sanitize MDC values before using them in FileAppender paths, allowing path-traversal attacks via sequences like "..", variable references, or special filename characters. An attacker with control over HTTP headers or other MDC inputs can traverse directories and create log files at arbitrary locations on the filesystem. The fix in version 1.6.5 now rejects MDC values that contain "..", slashes, variable syntax, or exceed 64 characters, returning a default value instead.

Affected products

  • QOS.CH Sarl Logback-classic 0.9.14 through 1.6.4

Timeline

  • 2026-10-02: disclosed
  • 2026-09-30: patched: Fixed in version 1.6.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.