CVE-2026-104721

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.

• CWE-22

• https://logback.qos.ch/news.html#1.6.5

Published

Oct 2, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104613A vulnerability was determined in CodeAstro Simple Pharmacy …6.3
• CVE-2026-104614A vulnerability was identified in CodeAstro Simple Pharmacy …6.3
• CVE-2026-104625A security flaw has been discovered in CodeAstro Simple Loan…6.3
• CVE-2026-104637A weakness has been identified in onetwothreeneth HospitalMa…7.3
• CVE-2026-104638A security vulnerability has been detected in onetwothreenet…5.3
• CVE-2026-1047The salavat counter Plugin plugin for WordPress is vulnerabl…4.4
• CVE-2026-104733User Impersonation in ProcessOnes XMMP Server ejabberd <= 26…7.4
• CVE-2026-1048A weakness has been identified in LigeroSmart up to 6.1.26. …5.4
• CVE-2026-104843uv is a Python package and project manager written in Rust. …5.9
• CVE-2026-104844PostCSS Selector Parser is a CSS selector parser that integr…5.9
• CVE-2026-104845Seroval facilitates JS value stringification, including comp…7.5
• CVE-2026-104846Seroval facilitates JS value stringification, including comp…9.8