Qos Ch Sarl
Monthly
Arbitrary code execution in QOS.CH logback-core versions up to and including 1.5.34 allows a local attacker with existing privilege to run code in the context of any Java application that loads Logback when the Janino library is on the classpath. The flaw circumvents prior hardening for CVE-2025-11226 via conditional configuration file processing, and is triggered either by writing to an existing logback configuration file or by injecting an environment variable that points the process at a malicious configuration. No public exploit identified at time of analysis, though the bypass nature of the issue makes weaponization of existing CVE-2025-11226 exploit code plausible.
Path traversal in Logback-classic versions 0.9.14 through 1.6.2 enables a remote unauthenticated attacker to create and append log files at arbitrary filesystem locations by injecting traversal sequences into an MDC (Mapped Diagnostic Context) value that flows unsanitized into a nested FileAppender path. Deployments using MDC-based discriminators - a pattern frequently triggered by HTTP header values automatically stored in MDC by web frameworks - are directly at risk. No public exploit code or active exploitation has been confirmed at time of analysis; vendor fix notes reference version 1.6.3 as the remediated release.
Deserialization restriction bypass in QOS.CH Sarl logback-core affects all versions through 1.5.33, allowing unauthenticated network attackers with the ability to influence serialized data to instantiate Java Proxy objects via SimpleSocketServer or SimpleSSLSocketServer. Despite the 'RCE' tag in source intelligence, the vendor explicitly states that no practical path to remote code execution or significant privilege escalation has been identified - this is a security boundary bypass of the HardenedObjectInputStream defense mechanism, not a full compromise vector. A proof-of-concept exists (CVSS E:P), though CVSS 4.0 scores the overall risk at 2.9 due to high attack complexity and prerequisite deployment conditions.
Arbitrary code execution in QOS.CH logback-core versions up to and including 1.5.34 allows a local attacker with existing privilege to run code in the context of any Java application that loads Logback when the Janino library is on the classpath. The flaw circumvents prior hardening for CVE-2025-11226 via conditional configuration file processing, and is triggered either by writing to an existing logback configuration file or by injecting an environment variable that points the process at a malicious configuration. No public exploit identified at time of analysis, though the bypass nature of the issue makes weaponization of existing CVE-2025-11226 exploit code plausible.
Path traversal in Logback-classic versions 0.9.14 through 1.6.2 enables a remote unauthenticated attacker to create and append log files at arbitrary filesystem locations by injecting traversal sequences into an MDC (Mapped Diagnostic Context) value that flows unsanitized into a nested FileAppender path. Deployments using MDC-based discriminators - a pattern frequently triggered by HTTP header values automatically stored in MDC by web frameworks - are directly at risk. No public exploit code or active exploitation has been confirmed at time of analysis; vendor fix notes reference version 1.6.3 as the remediated release.
Deserialization restriction bypass in QOS.CH Sarl logback-core affects all versions through 1.5.33, allowing unauthenticated network attackers with the ability to influence serialized data to instantiate Java Proxy objects via SimpleSocketServer or SimpleSSLSocketServer. Despite the 'RCE' tag in source intelligence, the vendor explicitly states that no practical path to remote code execution or significant privilege escalation has been identified - this is a security boundary bypass of the HardenedObjectInputStream defense mechanism, not a full compromise vector. A proof-of-concept exists (CVSS E:P), though CVSS 4.0 scores the overall risk at 2.9 due to high attack complexity and prerequisite deployment conditions.