Arbitrary Code Execution Vulnerability in QOS.CH Logback Core Product

CVE-2026-13006

What is CVE-2026-13006?

A vulnerability exists in QOS.CH logback-core, particularly in its handling of conditional configuration files in Java applications. This flaw allows attackers to execute arbitrary code by circumventing existing protections. The vulnerability requires the presence of the Janino library in the user's class path and the attacker must have write access to a configuration file. Alternatively, a malicious environment variable can be injected to point to a compromised configuration file, which also necessitates existing privileges. Proper securing of configuration files and access controls is crucial to mitigate this risk.

References