CVE-2026-104721

A flaw was found in logback-classic. This path traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. The issue occurs when an unsanitized Mapped Diagnostic Context (MDC) discriminator value flows into a nested log file path, enabling an attacker who can influence this context, such as through an HTTP request header, to manipulate the destination file location.