RHLW-2026-0cbc88c2ff3f926a

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-0cbc88c2ff3f926a.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-0cbc88c2ff3f926a.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-0cbc88c2ff3f926a
Upstream
  • CVE-2026-104721
Published
2026-11-05T14:20:47Z
Modified
2026-11-06T19:30:02Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green CVSS Calculator
Summary
Lightwell Security Advisory: logback-classic 1.5.18.rhlw-00006
Details

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.18.rhlw-00006 with a backported security fix.

CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.

This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.18 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / ch.qos.logback:logback-classic

Package

Name
ch.qos.logback:logback-classic
Purl
pkg:maven/ch.qos.logback/logback-classic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.18.rhlw-00006

Affected versions

0.*
0.2.5
0.3
0.5
0.6
0.7
0.7.1
0.8
0.8.1
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.30
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.4-groovyless
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.3.0-alpha0
1.3.0-alpha1
1.3.0-alpha2
1.3.0-alpha3
1.3.0-alpha4
1.3.0-alpha5
1.3.0-alpha6
1.3.0-alpha7
1.3.0-alpha8
1.3.0-alpha9
1.3.0-alpha10
1.3.0-alpha11
1.3.0-alpha12
1.3.0-alpha13
1.3.0-alpha14
1.3.0-alpha15
1.3.0-alpha16
1.3.0-beta0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.5.10
1.5.11
1.5.12
1.5.13
1.5.14
1.5.15
1.5.16
1.5.17
1.5.18

Database specific

lightwell 
{
    "backport_base_version": "1.5.18",
    "remediated_version": "1.5.18.rhlw-00006",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-0cbc88c2ff3f926a.json"