CVE-2026-19880 Incomplete protection against CVE-2025-11226
Attackers can create or append log files outside intended directories by manipulating MDC values, affecting Java applications using Logback-classic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19880?
CVE-2026-19880 is a medium-severity path traversal vulnerability in QOS.CH Sarl Logback-classic, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-19880?
Linux distribution packages (1)
logback openSUSE:Tumbleweed | All versions | 1.6.5-1.1 |
How do I fix CVE-2026-19880?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-19880 being exploited?
There is no known exploitation of CVE-2026-19880 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-FV50118, CLEANSTART-2026-HB84479, DEBIAN-CVE-2026-19880, GHSA-9mh8-hq67-v26g, OESA-2026-4014, RHLW-2026-21709a248f2eeb7d and 2 more.