QOS Logback-core up to 1.5.18 Environment Variable input validation

Summaryinfo

A vulnerability marked as problematic has been reported in QOS Logback-core up to 1.5.18. This affects an unknown function of the component Environment Variable Handler. The manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2025-11226. Local access is required to approach this attack. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in QOS Logback-core up to 1.5.18. This issue affects an unknown code of the component Environment Variable Handler. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must  have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

The weakness was disclosed by Heihu577. The advisory is shared at logback.qos.ch. The identification of this vulnerability is CVE-2025-11226 since 10/01/2025. The exploitation is known to be easy. An attack has to be approached locally. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 269701 (openSUSE 15 Security Update : logback (SUSE-SU-2025:03456-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.5.19 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (269701) and CERT Bund (WID-SEC-2025-2181). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• SUSE Linux
• SUSE openSUSE
• Open Source Logback

Productinfo

Vendor

• QOS

Name

• Logback-core

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9
• 1.5.10
• 1.5.11
• 1.5.12
• 1.5.13
• 1.5.14
• 1.5.15
• 1.5.16
• 1.5.17
• 1.5.18

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion