CVE-2026-1225: Malicious logback.xml configuration file allows instantiation of arbitrary classes
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.
The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/ch.qos.logback:logback-coreto a version that resolves this vulnerability.Fixed in 1.5.25 - Upgrade
Upgrade
logback-coreto a version that resolves this vulnerability.Fixed in 1.5.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1225?
CVE-2026-1225 is considered a critical vulnerability as it allows attackers to instantiate arbitrary classes through malicious configuration.
How do I fix CVE-2026-1225?
To mitigate CVE-2026-1225, update your logback-core dependency to version 1.5.25 or later.
What are the potential impacts of exploiting CVE-2026-1225?
Exploiting CVE-2026-1225 can lead to remote code execution, unauthorized access, and manipulation of application behavior.
Which versions of logback-core are affected by CVE-2026-1225?
CVE-2026-1225 affects logback-core versions up to and including 1.5.24.
What type of applications are vulnerable to CVE-2026-1225?
Java applications using the affected versions of the QOS.CH logback-core library are vulnerable to CVE-2026-1225.