CVE-2026-1225 Malicious logback.xml configuration file allows instantiation of arbitrary classes
Attackers with write access to logback.xml can instantiate arbitrary classpath classes, potentially leading to code execution in Java applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1225?
CVE-2026-1225 is a low-severity code injection vulnerability in QOS.CH Sarl Logback-core, published on 22 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.
The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
Weakness: CWE-20
Which versions are affected by CVE-2026-1225?
2 open source packages ship an affected version, including ch.qos.logback:logback-core.
| Package | Affected | Fixed in |
|---|---|---|
ch.qos.logback:logback-core Maven | All versions | 1.5.25 |
ch.qos.logback:logback-core Maven | All versions | 1.5.25 |
Linux distribution packages (2)
logback openSUSE:Leap 15.6 | All versions | 1.2.13-150200.3.16.1 |
logback openSUSE:Tumbleweed | All versions | 1.2.13-2.1 |
How do I fix CVE-2026-1225?
Upgrade ch.qos.logback:logback-core to 1.5.25 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-1225 being exploited?
There is no known exploitation of CVE-2026-1225 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-JS07100, CLEANSTART-2026-MZ20029, DEBIAN-CVE-2026-1225, ECHO-46b9-1587-a579, GHSA-qqpg-mvqg-649v, MINI-23rv-px9m-v8qv and 27 more.