Incomplete protection against CVE-2025-11226
Summary
| CVE | CVE-2026-13006 |
|---|---|
| State | PUBLISHED |
| Assigner | NCSC.ch |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-24 07:16:27 UTC |
| Updated | 2026-06-24 13:16:31 UTC |
| Description | ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.34 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. |
Risk And Classification
Primary CVSS: v4.0 7 HIGH from [email protected]
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green
Problem Types: CWE-20 | CWE-20 CWE-20 Improper Input Validation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7 | HIGH | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7 | HIGH | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/A... |
CVSS v4.0 Breakdown
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | QOS.CH Sarl | Logback-core | affected 0.9.20 1.5.134 maven | Java |
| CNA | QOS.CH Sarl | Logback-core | unaffected 1.5.35 maven | Java |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| logback.qos.ch/news.html | [email protected] | logback.qos.ch | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: IcySun ([email protected]) (en)
Additional Advisory Data
Solutions
CNA: Remove Janino from the Java classpath or update to logack version 1.5.35 or later. As of logback 1.5.20, the <condition> element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.
Workarounds
CNA: Remove Janino from the Java classpath or update to logack version 1.5.35 or later. As of logback 1.5.20, the <condition> element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.
Exploits
CNA: No known exploitation