Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-19880

Incomplete protection against CVE-2025-11226

Medium6.3EPSS 0.33%
Published
Updated
Reserved
Assigned by
NCSC.ch

Description

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.

Timeline

  1. ID reserved

    By NCSC.ch

  2. Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-19880, by who scored it
Scored byCVSSScoreVector
NCSC.chCNA (assigner)4.0Medium6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green
NVDNVD · Deferred4.0Medium6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green
EPSS (exploitation in 30 days)
0.33% · top 73% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

What to do

Solution: Update to logack version 1.6.3 or later. This vulnerability requires SiftingAppender to be active as well as unsanitized data provided by an attacker that MDCDiscriminator makes use of.  Sanitizing relevant data provided by the user should fix this vulnerability.

Workaround: Update to logack version 1.6.3 or later. This vulnerability requires SiftingAppender to be active as well as unsanitized data provided by an attacker that MDCDiscriminator makes use of.

Exploitation: No known exploitation

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-19880 badge
[![CVE-2026-19880](https://trackcve.app/badge/CVE-2026-19880.svg)](https://trackcve.app/cve/CVE-2026-19880)

Record last updated .