RHLW-2026-196ac03ad2d3efd8

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-196ac03ad2d3efd8.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-196ac03ad2d3efd8.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-196ac03ad2d3efd8
Upstream
  • CVE-2026-104721
Published
2026-11-05T14:20:47Z
Modified
2026-11-06T19:30:03Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green CVSS Calculator
Summary
Lightwell Security Advisory: logback-classic 1.5.13.rhlw-00004
Details

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.13.rhlw-00004 with a backported security fix.

CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.

This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.13 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / ch.qos.logback:logback-classic

Package

Name
ch.qos.logback:logback-classic
Purl
pkg:maven/ch.qos.logback/logback-classic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.13.rhlw-00004

Affected versions

0.*
0.2.5
0.3
0.5
0.6
0.7
0.7.1
0.8
0.8.1
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.30
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.4-groovyless
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.3.0-alpha0
1.3.0-alpha1
1.3.0-alpha2
1.3.0-alpha3
1.3.0-alpha4
1.3.0-alpha5
1.3.0-alpha6
1.3.0-alpha7
1.3.0-alpha8
1.3.0-alpha9
1.3.0-alpha10
1.3.0-alpha11
1.3.0-alpha12
1.3.0-alpha13
1.3.0-alpha14
1.3.0-alpha15
1.3.0-alpha16
1.3.0-beta0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.5.10
1.5.11
1.5.12
1.5.13

Database specific

lightwell 
{
    "backport_base_version": "1.5.13",
    "remediated_version": "1.5.13.rhlw-00004",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-196ac03ad2d3efd8.json"