CVE-2026-19880 MEDIUM

CVE-2026-19880: Incomplete protection against CVE-2025-11226

Vendor Qos.ch Sarl

Product Logback-classic

Weakness CWE-22 · Path traversal

Published August 14, 2026

Last update August 14, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green

What the vulnerability does

01Description

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2.

Key dates

02Disclosure timeline

August 14, 2026 CVE published

August 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-19880 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal

Related vulnerabilities

04Related CVE

CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action CVE-2026-9145 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value' CVE-2026-66493 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3 CVE-2026-61980 WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter