CVE-2025-11226: QOS.CH logback-core Arbitrary Code Execution Vulnerability
Summary
CVE-2025-11226: QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing. Affects ch.qos.logback:logback-core versions < 1.5.19. Fixed in 1.5.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QOS.CH logback-core is a widely used logging framework for Java applications, providing a robust and flexible logging solution. It allows developers to configure logging behavior through XML configuration files, enabling features such as logging levels, appenders, and layouts. However, versions up to 1.5.18 are vulnerable to an Arbitrary Code Execution (ACE) vulnerability due to improper handling of conditional configuration files, which can be exploited if an attacker has write access to the configuration files or can inject malicious environment variables.
Vulnerability Detail
The vulnerability arises from the conditional processing of configuration files in logback-core versions up to 1.5.18. An attacker can exploit this vulnerability by compromising an existing logback configuration file or injecting a malicious environment variable before the application executes. This requires the presence of the Janino library and Spring Framework on the class path, as well as existing privileges to write to the configuration file. If successful, the attacker can execute arbitrary code, potentially leading to severe consequences such as data breaches or system compromise.
How To Fix
Minimum fixed version
1.5.19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that configuration files are not writable by unauthorized users and avoid using environment variables that could point to malicious configuration files. Additionally, consider removing the Janino library and Spring Framework from the class path if they are not necessary for your application.
Conclusion
The CVE-2025-11226 vulnerability in QOS.CH logback-core poses a significant risk due to its potential for arbitrary code execution. It is crucial for users of affected versions to update to the patched version 1.5.19 or later and to implement workarounds to minimize exposure until the update can be applied.
See every vulnerability recorded for ch.qos.logback:logback-core →
FAQ
CVE-2025-11226 is a vulnerability in QOS.CH logback-core that allows for arbitrary code execution through improper handling of configuration files.
Versions of logback-core up to 1.5.18 are affected by this vulnerability.
An attacker must have write access to a configuration file or be able to inject a malicious environment variable. The Janino library and Spring Framework must also be present on the class path.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
If you cannot update to version 1.5.19 or later, implement the suggested workarounds to mitigate the risk until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for ch.qos.logback:logback-core.
