Description
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an
MDC-based discriminator value flows unsanitized into a nested
FileAppender path, letting an attacker who influences that MDC value
(e.g. via an HTTP header)
create and append log files outside the intended directory.
This issue affects Logback-classic: from 0.9.14 through 1.6.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QOS.CH Sarl | Logback-classic | 0.9.14 – ≤ 1.6.2 | 1.6.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | logback | 1:1.6.3-1 | — |
| Debian 13 | logback | No fix yet | — |
| Debian 12 | logback | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | logback | No fix yet | — |
| Ubuntu 26.04 LTS | logback | No fix yet | — |
| Ubuntu 24.04 LTS | logback | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | logback | No fix yet | — |
| Ubuntu Pro 20.04 LTS | logback | No fix yet | — |
| Ubuntu Pro 18.04 LTS | logback | No fix yet | — |
| Ubuntu Pro 16.04 LTS | logback | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP7 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP6 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | maven-artifact-transfer | 0.13.1-150200.3.15.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP5 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | maven-artifact-transfer | 0.13.1-150200.3.15.2 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLES 15 SP4 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP6 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | maven-artifact-transfer | 0.13.1-150200.3.15.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP5 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | maven-artifact-transfer | 0.13.1-150200.3.15.2 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLES for SAP 15 SP4 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | maven-artifact-transfer | 0.13.1-150200.3.15.2 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP5 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | apache-commons-cli | 1.9.0-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | aqute-bnd | 6.4.1-150200.3.16.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | glassfish-annotation-api | 1.3.2-150200.3.6.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | google-gson | 2.14.0-150200.3.13.2 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | httpcomponents-client | 4.5.14-150200.3.14.2 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | httpcomponents-core | 4.4.14-150200.3.11.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | jline3 | 3.30.17-150200.5.11.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | maven | 3.10.0-150200.4.36.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | maven-artifact-transfer | 0.13.1-150200.3.15.2 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | maven-resolver | 2.0.24-150200.3.32.3 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | maven-wagon | 3.5.3-150200.3.10.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | methanol | 1.9.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | osgi-annotation | 8.1.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | osgi-compendium | 7.0.0-150200.3.9.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | osgi-service-subsystem | 1.1.0-150200.5.3.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | slf4j | 2.0.20-150200.3.7.1 | SUSE-SU-2026:5189-1 |
| SLE HPC 15 SP4 | xmvn +3 | 4.3.0-150200.3.33.1 | SUSE-SU-2026:5189-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | logback | 1.6.5-1.1 | openSUSE-SU-2026:11965-1 |
Advisories 4
- SUSE-SU-2026:5189-1 Security update for apache-parent, aqute-bnd, google-gson, logback, maven, maven-artifact-transfer, maven-parent, maven-resolver, methanol, osgi-service-subsystem, slf4j, xmvn SUSE / openSUSE Security Updates · Nov 11, 2026
- openSUSE-SU-2026:11965-1 logback-1.6.5-1.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026
- WID-SEC-2026-3403 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 24, 2026
- NCSC-2026-0375 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Sep 16, 2026