PT-2025-40064 · Unknown+2 · Logback-Core+3

·

CVE-2025-11226

·

Published

2025-10-01

·

Updated

2026-07-21

CVSS v4.0

7.0

High

VectorAV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green
Name of the Vulnerable Software and Affected Versions logback-core versions up to and including 1.5.18
Description A flaw exists in the conditional configuration file processing within logback-core, potentially allowing an attacker to execute arbitrary code. This is possible by compromising an existing logback configuration file or injecting a malicious environment variable before program execution. Successful exploitation requires the presence of the Janino library and the Spring Framework on the user's class path, as well as write access to a configuration file or the ability to inject a malicious environment variable. The issue involves the QOS.CH component.
Recommendations Update logback-core to a version later than 1.5.18.

Fix

DoS

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2025-11226
GHSA-25QH-J22F-PWP8
OPENSUSE-SU-2025:15597-1
SUSE-SU-2025:03456-1

Affected Products

Confluence
Janino
Spring Framework
Logback-Core