RHLW-2026-b7f60b9979a4b5a4: Lightwell Security Advisory: logback-classic 1.5.38.rhlw-00006
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.38.rhlw-00006 with a backported security fix.
CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.38 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/ch.qos.logback:logback-classicto a version that resolves this vulnerability.Fixed in 1.5.38.rhlw-00006 - Upgrade
Upgrade
ch.qos.logback:logback-classicto a version that resolves this vulnerability.Fixed in 1.5.38.rhlw-00006
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments using the logback-classic module are exposed when an MDC-based discriminator value is incorporated into a nested FileAppender path. The risk is especially relevant where an external party can influence the MDC value, such as through an HTTP header.
What must an attacker be able to do to exploit the vulnerability?
An attacker must be able to influence the MDC-based discriminator value used in the nested FileAppender path. An unsanitized value can then be used for path traversal to create and append log files outside the intended directory.
What version should be used to address this issue in Red Hat Lightwell?
Red Hat Lightwell released ch.qos.logback:logback-classic 1.5.38.rhlw-00006 with a backported security fix. It is a drop-in replacement for ch.qos.logback:logback-classic 1.5.38 from Maven Central.
How can I determine whether my application is affected?
Check whether the application uses logback-classic and has a configuration where an MDC-based discriminator feeds into a nested FileAppender path. Also determine whether the relevant MDC value can be influenced by untrusted input, such as an HTTP header.