RHLW-2026-196ac03ad2d3efd8: Lightwell Security Advisory: logback-classic 1.5.13.rhlw-00004
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.13.rhlw-00004 with a backported security fix.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.13 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/ch.qos.logback:logback-classicto a version that resolves this vulnerability.Fixed in 1.5.13.rhlw-00004 - Upgrade
Upgrade
ch.qos.logback:logback-classicto a version that resolves this vulnerability.Fixed in 1.5.13.rhlw-00004
Event History
Frequently Asked Questions
Which deployments are actually exposed to this issue?
Exposure requires a Logback configuration in which an MDC-based discriminator value is used in a nested FileAppender path. The affected upstream Logback-classic range is 0.9.14 through 1.6.4.
What does an attacker need to exploit the vulnerability?
An attacker must be able to influence the MDC discriminator value used by the application’s FileAppender path. The advisory gives an HTTP header as an example of an attacker-controlled input that could reach MDC.
Does use of the affected Logback-classic version alone mean the application is vulnerable?
No. The described path traversal depends on an unsanitized MDC-based discriminator value flowing into a nested FileAppender path; the advisory does not state that every default configuration has this setup.
What is the available remediation for users of the Red Hat Lightwell artifact?
Use ch.qos.logback:logback-classic 1.5.13.rhlw-00004, which contains a backported security fix. It is described as a drop-in replacement for ch.qos.logback:logback-classic 1.5.13 from Maven Central.
How can teams assess whether their application may already be affected?
Review Logback configuration for nested FileAppender paths that incorporate MDC discriminator values, and identify whether those MDC values can be populated from untrusted input such as HTTP headers. Also verify whether the deployed Logback-classic version falls within 0.9.14 through 1.6.4.