CVE-2026-104721 Logback: Incomplete protection against CVE-2026-19880
Attackers can create or append log files outside intended directories by manipulating MDC values, affecting Java applications using Logback.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-104721?
CVE-2026-104721 is a medium-severity path traversal vulnerability in QOS.CH Sarl Logback-classic, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
Weakness: CWE-22
Which versions are affected by CVE-2026-104721?
Linux distribution packages (1)
logback openSUSE:Tumbleweed | All versions | 1.6.5-2.1 |
How do I fix CVE-2026-104721?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-104721 being exploited?
There is no known exploitation of CVE-2026-104721 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-104721, GHSA-5f86-rhcp-cxm6, UBUNTU-CVE-2026-104721, openSUSE-SU-2026:11985-1.