CVE-2026-13006 (GCVE-0-2026-13006)
Vulnerability from cvelistv5
Published
2026-06-24 05:41
Modified
2026-07-01 11:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-20 - Improper Input Validation
Summary
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must have write access to a
configuration file. Alternatively, the attacker could inject a malicious
environment variable pointing to a malicious configuration file. In both
cases, the attack requires existing privilege.
Please note that in logack version 1.5.37 conditional processing using Janino was removed.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| QOS.CH Sarl | Logback-core |
Version: 0.9.20 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13006",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-24T12:24:18.335394Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T12:24:27.699Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"logback-core"
],
"platforms": [
"Java"
],
"product": "Logback-core",
"vendor": "QOS.CH Sarl",
"versions": [
{
"lessThanOrEqual": "1.5.36",
"status": "affected",
"version": "0.9.20",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "1.5.37",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "IcySun (icysun@qq.com)"
},
{
"lang": "en",
"type": "finder",
"value": "\"yulate\" (yulate531@gmail.com.com)"
}
],
"datePublic": "2026-06-23T11:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by\u0026nbsp;compromising an existing logback configuration file or by injecting an environment variable before program execution.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eA successful attack requires the presence of Janino library to be present on the user\u0027s class path. In addition, the attacker must\u0026nbsp; have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege.\u003cbr\u003e\u003cbr\u003e\u003cb\u003ePlease note that in logack version 1.5.37 conditional processing using Janino was removed.\u003c/b\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by\u00a0compromising an existing logback configuration file or by injecting an environment variable before program execution.\n\n\n\nA successful attack requires the presence of Janino library to be present on the user\u0027s class path. In addition, the attacker must\u00a0 have write access to a \nconfiguration file. Alternatively, the attacker could inject a malicious \nenvironment variable pointing to a malicious configuration file. In both \ncases, the attack requires existing privilege.\n\nPlease note that in logack version 1.5.37 conditional processing using Janino was removed."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known exploitation\u003cbr\u003e"
}
],
"value": "No known exploitation"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Arbitrary code execution on previously compromised system"
}
]
},
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "NOT_DEFINED",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:N/RE:M/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T11:05:37.718Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"url": "https://logback.qos.ch/news.html#1.5.37"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\u0026nbsp;As of logback 1.5.20, the \u0026lt;condition\u0026gt;\u0026nbsp;element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.\u0026nbsp;"
}
],
"value": "Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\u00a0As of logback 1.5.20, the \u003ccondition\u003e\u00a0element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Incomplete protection against CVE-2025-11226",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\u0026nbsp;As of logback 1.5.20, the \u0026lt;condition\u0026gt;\u0026nbsp;element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.\u0026nbsp;\u0026nbsp;"
}
],
"value": "Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\u00a0As of logback 1.5.20, the \u003ccondition\u003e\u00a0element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-13006",
"datePublished": "2026-06-24T05:41:32.197Z",
"dateReserved": "2026-06-23T14:31:36.004Z",
"dateUpdated": "2026-07-01T11:05:37.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13006\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-24T12:24:18.335394Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-24T12:24:24.228Z\"}}], \"cna\": {\"title\": \"Incomplete protection against CVE-2025-11226\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"IcySun (icysun@qq.com)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"\\\"yulate\\\" (yulate531@gmail.com.com)\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Arbitrary code execution on previously compromised system\"}]}, {\"capecId\": \"CAPEC-242\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-242 Code Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"PRESENT\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7, \"Automatable\": \"NO\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:N/RE:M/U:Green\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"GREEN\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"MODERATE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"QOS.CH Sarl\", \"modules\": [\"logback-core\"], \"product\": \"Logback-core\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.9.20\", \"versionType\": \"maven\", \"lessThanOrEqual\": \"1.5.36\"}, {\"status\": \"unaffected\", \"version\": \"1.5.37\", \"versionType\": \"maven\"}], \"platforms\": [\"Java\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"No known exploitation\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"No known exploitation\u003cbr\u003e\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\\u00a0As of logback 1.5.20, the \u003ccondition\u003e\\u00a0element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\u0026nbsp;As of logback 1.5.20, the \u0026lt;condition\u0026gt;\u0026nbsp;element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.\u0026nbsp;\", \"base64\": false}]}], \"datePublic\": \"2026-06-23T11:09:00.000Z\", \"references\": [{\"url\": \"https://logback.qos.ch/news.html#1.5.37\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\\u00a0As of logback 1.5.20, the \u003ccondition\u003e\\u00a0element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Remove Janino from the Java classpath or update to logack version 1.5.37 or later.\u0026nbsp;As of logback 1.5.20, the \u0026lt;condition\u0026gt;\u0026nbsp;element with a custom PropertyEvaluator offers a recommended alternative to conditionals requiring Janino.\u0026nbsp;\u0026nbsp;\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by\\u00a0compromising an existing logback configuration file or by injecting an environment variable before program execution.\\n\\n\\n\\nA successful attack requires the presence of Janino library to be present on the user\u0027s class path. In addition, the attacker must\\u00a0 have write access to a \\nconfiguration file. Alternatively, the attacker could inject a malicious \\nenvironment variable pointing to a malicious configuration file. In both \\ncases, the attack requires existing privilege.\\n\\nPlease note that in logack version 1.5.37 conditional processing using Janino was removed.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by\u0026nbsp;compromising an existing logback configuration file or by injecting an environment variable before program execution.\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eA successful attack requires the presence of Janino library to be present on the user\u0027s class path. In addition, the attacker must\u0026nbsp; have write access to a \\nconfiguration file. Alternatively, the attacker could inject a malicious \\nenvironment variable pointing to a malicious configuration file. In both \\ncases, the attack requires existing privilege.\u003cbr\u003e\u003cbr\u003e\u003cb\u003ePlease note that in logack version 1.5.37 conditional processing using Janino was removed.\u003c/b\u003e\u003c/div\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"455daabc-a392-441d-aa46-37d35189897c\", \"shortName\": \"NCSC.ch\", \"dateUpdated\": \"2026-07-01T11:05:37.718Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-13006\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-01T11:05:37.718Z\", \"dateReserved\": \"2026-06-23T14:31:36.004Z\", \"assignerOrgId\": \"455daabc-a392-441d-aa46-37d35189897c\", \"datePublished\": \"2026-06-24T05:41:32.197Z\", \"assignerShortName\": \"NCSC.ch\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…