CVE-2025-11226

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

CVSS

No CVSS.

References

Link	Resource
https://logback.qos.ch/news.html#1.3.16
https://logback.qos.ch/news.html#1.5.19

Configurations

No configuration.

History

09 Oct 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ACE en el procesamiento condicional de archivos de configuración por QOS.CH logback-core hasta la versión 1.5.18 inclusive en aplicaciones Java, permite a un atacante ejecutar código arbitrario comprometiendo un archivo de configuración logback existente o inyectando una variable de entorno antes de la ejecución del programa. Un ataque exitoso requiere la presencia de la biblioteca Janino y Spring Framework en el classpath del usuario. Además, el atacante debe tener acceso de escritura a un archivo de configuración. Alternativamente, el atacante podría inyectar una variable de entorno maliciosa que apunte a un archivo de configuración malicioso. En ambos casos, el ataque requiere privilegios existentes.

Information

Published : 2025-10-01 08:15

Updated : 2026-10-09 09:10

NVD link : CVE-2025-11226

Mitre link : CVE-2025-11226

CVE.ORG link : CVE-2025-11226

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-11226", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11226", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-25T16:04:36.111603Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "QOS.CH Sarl", "modules": ["logback-core"], "product": "Logback-core", "versions": [{"status": "affected", "version": "0.9.20", "versionType": "maven", "lessThanOrEqual": "1.5.18"}, {"status": "unaffected", "version": "1.5.19"}, {"status": "unaffected", "version": "1.3.16"}], "platforms": ["Java"], "defaultStatus": "affected"}]}], "published": "2025-10-01T08:15:31.250", "references": [{"url": "https://logback.qos.ch/news.html#1.3.16", "source": "vulnerability@ncsc.ch"}, {"url": "https://logback.qos.ch/news.html#1.5.19", "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.\n\n\n\nA successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must\u00a0 have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege."}, {"lang": "es", "value": "Una vulnerabilidad ACE en el procesamiento condicional de archivos de configuraci\u00f3n por QOS.CH logback-core hasta la versi\u00f3n 1.5.18 inclusive en aplicaciones Java, permite a un atacante ejecutar c\u00f3digo arbitrario comprometiendo un archivo de configuraci\u00f3n logback existente o inyectando una variable de entorno antes de la ejecuci\u00f3n del programa.\n\nUn ataque exitoso requiere la presencia de la biblioteca Janino y Spring Framework en el classpath del usuario. Adem\u00e1s, el atacante debe tener acceso de escritura a un archivo de configuraci\u00f3n. Alternativamente, el atacante podr\u00eda inyectar una variable de entorno maliciosa que apunte a un archivo de configuraci\u00f3n malicioso. En ambos casos, el ataque requiere privilegios existentes."}], "lastModified": "2026-10-09T09:10:00.213", "sourceIdentifier": "vulnerability@ncsc.ch"}