The vulnerability arises because an MDC‑based discriminator value is written directly into a nested FileAppender path without sanitization. When an attacker can influence this MDC value – for example, by sending a crafted HTTP header – they can cause the logback engine to create or append log files to arbitrary locations on the file system. This path‑traversal flaw is identified as CWE‑22 and permits uncontrolled file creation or overwriting outside the intended log directory, potentially exposing sensitive data or enabling further malicious activity.

QOS.CH Sarl Logback‑classic, versions 0.9.14 through 1.6.2, used in Java applications that load the logback‑classic module. Any Java runtime that relies on these versions of Logback is potentially affected, particularly environments where an HTTP layer populates MDC values that are later used by a FileAppender.

The CVSS score is 6.3, indicating a medium severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented. Exploitation requires that the SiftingAppender component be active and that an attacker can supply unsanitized MDC data; if either condition is not satisfied, the attack surface is reduced. The likely attack vector is through HTTP headers or other avenues that feed into MDC, meaning the vulnerability is potentially exploitable over a network-facing interface when proper input validation is omitted.