CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.

• CWE-22

• https://logback.qos.ch/news.html#1.6.3

Published

Aug 14, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19872HTML::FormHandler versions before 0.410000 for Perl allow cr…6.1
• CVE-2026-19873HTML::FormFu versions through 2.08 for Perl allow resource e…7.5
• CVE-2026-19874A heap-based buffer overflow vulnerability exists in Konami'…9.1
• CVE-2026-19875IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote a…7.5
• CVE-2026-19879A flaw was found in Undertow, an HTTP server, within its HTT…5.3
• CVE-2026-1988The Flexi Product Slider and Grid for WooCommerce plugin for…7.5
• CVE-2026-19883The WPeMatico RSS Feed Fetcher plugin for WordPress is vulne…8.8
• CVE-2026-19884In Eclipse Theia versions up to and including 1.69.0, openin…8.4
• CVE-2026-19885OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Writ…7.8
• CVE-2026-19886OriginLab Origin Viewer OGM File Parsing Memory Corruption R…7.8
• CVE-2026-19887The Welcart e-Commerce plugin for WordPress is vulnerable to…8.8
• CVE-2026-19889GitLab has remediated a vulnerability in the GitLab AI Gatew…8.2