CVE-2025-11226
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-01

Last updated on: 2025-10-31

Assigner: Switzerland Government Common Vulnerability Program

Description
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must  have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-01
Last Modified
2025-10-31
Generated
2026-06-16
AI Q&A
2025-10-01
EPSS Evaluated
2026-06-15
NVD
CVE-2025-11226
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
qos logback-core 1.3.16
qos logback-core 1.5.19
qos logback-core 1.5.18
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-11226 is an Arbitrary Code Execution (ACE) vulnerability in the Logback logging framework's JaninoEventEvaluator component. It allows an attacker with existing privileges to execute arbitrary code by compromising a logback configuration file or injecting a malicious environment variable before program execution. The attack requires the presence of the Janino library and Spring Framework on the class path and write access to configuration files or the ability to inject environment variables. [1]

Impact Analysis

This vulnerability can allow an attacker who already has some level of access to escalate their privileges by executing arbitrary code within your Java application environment. This could lead to unauthorized actions, data manipulation, or further compromise of the system, especially if the attacker can modify configuration files or environment variables. [1]

Detection Guidance

You can detect this vulnerability by checking the version of the Logback library used in your Java applications. Specifically, versions up to and including 1.5.18 are vulnerable. Use commands to inspect your application's dependencies or installed packages to identify the Logback version. For example, if using Maven, run 'mvn dependency:tree | grep logback' to find the Logback version. Alternatively, check your application's classpath or JAR files for logback-core version. Also, inspect your logback configuration files for the presence of JaninoEventEvaluator or any suspicious environment variable injections that could be exploited. There are no specific network detection commands provided. [1]

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade the Logback library to version 1.5.13 or later, as these versions have removed the vulnerable JaninoEventEvaluator component. Additionally, ensure that your logback configuration files do not contain malicious or untrusted code, and restrict write access to these configuration files to prevent attackers from injecting malicious content. Also, avoid setting untrusted environment variables that could influence configuration file loading. These steps will prevent arbitrary code execution via this vulnerability. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart