CVE-2025-11226 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino
Attackers with existing privileges can execute arbitrary code in Java applications using Logback, Janino, and Spring by manipulating configuration files or environment variables.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11226?
CVE-2025-11226 is a high-severity code injection vulnerability in QOS.CH Sarl Logback-core, published on 1 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
Weakness: CWE-20
Which versions are affected by CVE-2025-11226?
4 open source packages ship an affected version, including ch.qos.logback:logback-core.
| Package | Affected | Fixed in |
|---|---|---|
ch.qos.logback:logback-core Maven | All versions | 1.3.16 |
ch.qos.logback:logback-core Maven | All versions | 1.3.16 |
ch.qos.logback:logback-core Maven | From 1.4.0 | 1.5.19 |
ch.qos.logback:logback-core Maven | From 1.4.0 | 1.5.19 |
Linux distribution packages (1)
logback openSUSE:Leap 15.6 | All versions | 1.2.13-150200.3.13.1 |
How do I fix CVE-2025-11226?
Upgrade ch.qos.logback:logback-core to a fixed version for your release line: 1.3.16 or 1.5.19.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-11226 being exploited?
There is no known exploitation of CVE-2025-11226 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-JM74413, CLEANSTART-2026-YC63582, CLSA-2025-1765930089, CLSA-2026-1784769539, CLSA-2026-1785917146, CLSA-2026-1786355016 and 25 more.