CVE-2026-19880 Incomplete protection against CVE-2025-11226

🗓️ 14 Aug 2026 14:31:02Reported by NCSC.chType

Path traversal in Logback-classic 0.9.14-1.6.2 via unsanitized MDC value into FileAppender path.

Reporter	Title	Published	Views	Family All 38
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	22 Sep 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26	12 Oct 202611:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path-traversal in QOS.CH Sarl Logback-classic (CVE-2026-19880)	22 Oct 202619:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	28 Sep 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BigMemory Max is affected by Logback vulnerabilities that could allow an attacker to supply malicious input (such as an HTTP header) and cause arbitrary log files to be created and written outside the intended directory	3 Nov 202613:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed	3 Sep 202602:53	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	1 Oct 202610:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Intelligence Client Managed Software (Formerly Known as IBM Automation Decision Services) for Sept 2026- Multiple CVEs addressed	5 Oct 202616:26	–	ibm
attackerkb	CVE-2026-19880	14 Aug 202614:31	–	attackerkb
CVE	CVE-2026-19880	14 Aug 202614:31	–	cve

[
  {
    "vendor": "QOS.CH Sarl",
    "product": "Logback-classic",
    "platforms": [
      "Java"
    ],
    "modules": [
      "logback-classic"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "0.9.14",
        "lessThanOrEqual": "1.6.2",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "1.6.3",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "affected"
  }
]

Source	Link
logback	www.logback.qos.ch/news.html

14 Aug 2026 14:31Current

CVSS 46.3

EPSS0.00332

SSVC

CWE-22