CVE-2026-19880

🗓️ 14 Aug 2026 14:31:02Reported by NCSC.chType

Logback-classic 0.9.14-1.6.2: unsanitized MDC value in FileAppender path creates files outside dir.

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	22 Sep 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26	12 Oct 202611:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic (CVE-2026-19880)	22 Oct 202619:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	28 Sep 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BigMemory Max is affected by Logback vulnerabilities that could allow an attacker to supply malicious input (such as an HTTP header) and cause arbitrary log files to be created and written outside the intended directory	3 Nov 202613:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed	3 Sep 202602:53	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Oct 202610:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Intelligence Client Managed Software (Formerly Known as IBM Automation Decision Services) for Sept 2026- Multiple CVEs addressed	5 Oct 202616:26	–	ibm
attackerkb	CVE-2026-19880	14 Aug 202614:31	–	attackerkb
Cvelist	CVE-2026-19880 Incomplete protection against CVE-2025-11226	14 Aug 202614:31	–	cvelist

Vulners

Node

qos logbackRange0.9.14–1.6.2

[
  {
    "vendor": "QOS.CH Sarl",
    "product": "Logback-classic",
    "platforms": [
      "Java"
    ],
    "modules": [
      "logback-classic"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0.9.14",
        "lessThanOrEqual": "1.6.2",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "1.6.3",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
logback	www.logback.qos.ch/news.html

26 Aug 2026 16:39Current

5.9Medium risk

Vulners AI Score5.9

CVSS 46.3

EPSS0.00332

SSVC

CWE-22