# CVE-2025-11226: QOS.CH Logback-core code execution in conditional configuration processing

Source: https://junglewise.ai/threats/cve-2025-11226-qos-ch-logback-core-code-execution-in-conditional-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-01. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2025-11226 · Severity: medium · CVSS 4 · Published 2025-10-01

Logback is a popular logging framework used by Java applications to record system events. A vulnerability in how it processes configuration files could allow an attacker who already has high-level access to the system to execute malicious code. To be successful, the attacker must be able to modify the application's configuration files or environment variables, and the application must be using specific common Java libraries like Spring Framework.

Technologies: [ch.qos.logback:logback-core (Maven)](https://junglewise.ai/threats/technologies/ch-qos-logback-logback-core), [QOS.CH Sarl Logback-Core](https://junglewise.ai/threats/technologies/logback-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [QOS.CH Sarl](https://junglewise.ai/threats/vendors/qos-ch-sarl).

## Quick answers

**Is CVE-2025-11226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-11226 being exploited in the wild.

**How severe is CVE-2025-11226?** Medium severity, with a CVSS score of 4, published 1 October 2025.

**Which products and versions are affected?** ch.qos.logback:logback-core (Maven) ECOSYSTEM:introduced=1.4.0,fixed=1.5.19; QOS.CH Sarl Logback-Core 0.9.20 to 1.5.18.

**Is there a fix for CVE-2025-11226?** Yes. ch.qos.logback:logback-core (Maven): upgrade to 1.5.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-11226 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-11226?** Check whether you run ch.qos.logback:logback-core (Maven) or QOS.CH Sarl Logback-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ch.qos.logback:logback-core (Maven): upgrade to 1.5.19 or later

  ```sh
  # set ch.qos.logback:logback-core to 1.5.19 in your pom.xml or build.gradle
  ```


## Technical details

An Arbitrary Code Execution (ACE) vulnerability exists in logback-core versions up to 1.5.18 during the processing of conditional configuration files. The vulnerability is triggered when an attacker with existing high privileges (PR:H) modifies a logback configuration file or injects an environment variable pointing to a malicious configuration. Exploitation requires the Janino library and Spring Framework to be present on the application's classpath. This allows the attacker to execute arbitrary Java code through the configuration's conditional logic. The issue is addressed in versions 1.3.16 and 1.5.19.

## Affected products

- QOS.CH Sarl Logback-core 0.9.20 to 1.5.18

## Identifiers

- CVE-2025-11226
- GHSA-25qh-j22f-pwp8

## Timeline

- 2025-10-01: disclosed
- 2025-10-01: advisory

## References

- [https://logback.qos.ch/news.html](https://logback.qos.ch/news.html)
- [https://logback.qos.ch/news.html](https://logback.qos.ch/news.html)

## Related threats

- [QOS.CH Sarl logback-core restricted deserialization in HardenedObjectInputStream](https://junglewise.ai/threats/cve-2026-10532-qos-ch-sarl-logback-core-restricted-deserialization-in)
- [QOS.CH logback-core deserialization bypass in HardenedObjectInputStream](https://junglewise.ai/threats/cve-2026-9828-qos-ch-logback-core-deserialization-bypass-in)
- [Logback allows an attacker to instantiate classes already present on the class path](https://junglewise.ai/threats/cve-2026-1225-logback-allows-an-attacker-to-instantiate-classes-already-present)
- [QOS.CH logback-core Expression Language Injection vulnerability](https://junglewise.ai/threats/cve-2024-12798-qos-ch-logback-core-expression-language-injection-vulnerability)
- [QOS.CH logback-core Server-Side Request Forgery vulnerability](https://junglewise.ai/threats/cve-2024-12801-qos-ch-logback-core-server-side-request-forgery-vulnerability)