CVE-2026-104721

Overview

Logback is an open-source Java logging framework designed as a successor to Log4j. Its core module provides logging infrastructure, logback-classic implements the SLF4J API, and logback-access supplies HTTP access logging for servlet containers.

A path traversal vulnerability (CVE-2026-104721) has been identified in the MDCBasedDiscriminator used by Logback's SiftingAppender, which allows attackers who can influence an MDC value (for example, through an HTTP header) to create and append to log files outside the intended directory.

Per OWASP: A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.

This issue affects multiple versions of Logback.

Details

Module Info

• Product: Logback
• Affected packages: ch.qos.logback:logback-classic
• Affected versions: >=0.9.14 <=1.6.4
• GitHub repository: https://github.com/qos-ch/logback
• Published packages: https://central.sonatype.com/artifact/ch.qos.logback/logback-classic
• Package manager: Maven
• Fixed in:
  • OSS Logback 1.6.5
  • NES for Logback v1.2.15

Vulnerability Info

This Medium-severity vulnerability is found in the ch.qos.logback:logback-classic package in multiple versions of Logback. SiftingAppender builds a separate nested appender for each distinct discriminating value, and the configuration of that nested appender refers to the value by its key, for example <file>${userid}.log</file> inside a FileAppender. The default discriminator, MDCBasedDiscriminator, reads the configured key from the event's MDC and returns the value as it is:

public String getDiscriminatingValue(ILoggingEvent event) {
    Map<String, String> mdcMap = event.getMDCPropertyMap();
    if (mdcMap == null) {
        return defaultValue;
    }
    String mdcValue = mdcMap.get(key);
    if (mdcValue == null) {
        return defaultValue;
    } else {
        return mdcValue;
    }
}

Applications commonly fill the MDC from request data such as a user name, tenant ID or HTTP header. When an attacker controls that data, the returned string is placed directly into the nested appender's file path. Path separators, .. sequences and other characters that have meaning in the nested configuration, such as variable substitution expressions, therefore reach the file name unchecked. The nested FileAppender then creates and appends to a file at a location of the attacker's choosing, outside the directory the configuration intended. Removing only the forward and backward slashes from the value does not fully close this path, because other values can still alter the resulting file name. The issue can only be exploited when SiftingAppender is active with an MDC key whose value an attacker can influence.

Mitigation

Logback 1.2.x is End-of-Life and will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported version of Logback.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• François Martin (finder)