The vulnerability is a path‑traversal flaw in Logback-classic where a value derived from the MDCDiscriminator, if left unsanitized, is concatenated into a nested FileAppender path. An attacker that can influence the MDC value—for example by supplying a custom HTTP header—can instruct Logback to write to arbitrary file locations. This allows the creation or modification of files outside the intended logging directory, potentially leading to denial of service, data tampering, or the addition of arbitrary content that could be read by subsequent processes.

The issue affects QOS.CH Sarl Logback-classic versions 0.9.14 through 1.6.4. These versions are common in Java applications that use Logback for logging.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires that the application be configured with a SiftingAppender that uses an unsanitized MDCDiscriminator, and that an attacker be able to supply or manipulate the MDC value. The attack vector is likely an HTTP or other request header that feeds into the MDC. Because the flaw involves a configuration detail, the risk is moderate but can become critical if unsanitized data is used in a widely exposed application.