RHLW-2026-b7f60b9979a4b5a4

    Dashboard / Vulnerabilities / RHLW-2026-b7f60b9979a4b5a4

    RHLW-2026-b7f60b9979a4b5a4

    Published: 5 Nov 2026Last Modified: 6 Nov 2026
    Upstream:
    CVE-2026-104721

    Summary: Lightwell Security Advisory: logback-classic 1.5.38.rhlw-00006

    Details: Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.38.rhlw-00006 with a backported security fix. CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques. This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.38 from Maven Central.

    References: https://nvd.nist.gov/vuln/detail/CVE-2026-104721

    Affected packages

    Package

    Name: ch.qos.logback:logback-classic

    Purl: pkg:maven/ch.qos.logback/logback-classic

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.5.38.rhlw-00006

    Affected versions

    0.2.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RHLW-2026-b7f60b9979a4b5a4 | CVE-DB