CVE-2026-13006— QOS.CH Sarl logback 输入验证错误漏洞

Incomplete protection against CVE-2025-11226

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must  have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. Please note that in logack version 1.5.37 conditional processing using Janino was removed.

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:N/RE:M/U:Green

输入验证不恰当

QOS.CH Sarl logback 输入验证错误漏洞

QOS.CH Sarl logback是QOS.CH Sarl的日志框架。 Logback-core 1.5.34及之前版本存在输入验证错误漏洞，该漏洞源于条件配置文件处理中的ACE漏洞，可能导致攻击者通过破坏现有配置文件或在程序执行前注入环境变量绕过对CVE-2025-11226的保护，从而执行任意代码。

N/A

N/A