Executive brief
Logback is a widely used Java logging library. A vulnerability in how it processes configuration files allows an attacker with existing high-level access to execute malicious code on the server. To exploit this, an attacker must be able to modify the application's configuration files or environment variables, and the system must use the optional Janino library. While this requires significant prior access, it could allow an attacker to escalate their control over the affected application.
Technical details
An Arbitrary Code Execution (ACE) vulnerability exists in logback-core versions up to 1.5.34 due to improper input validation in the 'condition' attribute of <if> elements. Specifically, the library fails to reject unicode escape sequences (\u and \U), which can be used to bypass existing protections against the 'new' operator in Janino-evaluated conditions. An attacker with write access to the logback configuration file, or the ability to inject environment variables pointing to a malicious configuration file, can achieve code execution if the Janino library is on the classpath. This vulnerability is a bypass for CVE-2025-11226. Users should upgrade to version 1.5.35 or later.
Affected products
- QOS.CH logback-core >= 0.9.20, <= 1.5.34
Timeline
- 2026-06-23: patched: Release of version 1.5.35 fixes the issue.
- 2026-06-24: advisory: CVE-2026-13006 published.