QOS Logback-core up to 1.5.24 Configuration File information disclosure

Summaryinfo

A vulnerability marked as problematic has been reported in QOS Logback-core up to 1.5.24. This affects an unknown part of the component Configuration File Handler. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2026-1225. The attack needs to be performed locally. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in QOS Logback-core up to 1.5.24 and classified as problematic. This issue affects an unknown code of the component Configuration File Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

It is possible to read the advisory at logback.qos.ch. The identification of this vulnerability is CVE-2026-1225 since 01/20/2026. The exploitation is known to be difficult. Attacking locally is a requirement. The exploitation needs additional levels of successful authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 1.5.25 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0202). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• SUSE openSUSE
• Open Source Logback

Productinfo

Vendor

• QOS

Name

• Logback-core

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.5.5
• 1.5.6
• 1.5.7
• 1.5.8
• 1.5.9
• 1.5.10
• 1.5.11
• 1.5.12
• 1.5.13
• 1.5.14
• 1.5.15
• 1.5.16
• 1.5.17
• 1.5.18
• 1.5.19
• 1.5.20
• 1.5.21
• 1.5.22
• 1.5.23
• 1.5.24

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion