1.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1225

CVE-2026-1225: Logback allows an attacker to instantiate classes already present on the class path

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.

The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1225

CVE-2026-1225:

1.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ch.qos.logback:logback-core	maven	< 1.5.25	1.5.25

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-1225, allows an attacker with write access to a logback configuration file to instantiate arbitrary classes on the classpath. This is a form of Arbitrary Code Execution (ACE). The root cause lies in how logback processes <appender-ref> elements in its XML configuration. When an appender-ref refers to an appender name that doesn't exist, particularly when using property substitution like ${some.property}, logback's underlying property substitution mechanism would attempt to interpret the unresolved value as a fully qualified class name and instantiate it. This 'helpful' feature becomes a vulnerability when an attacker can control the value of the property.

The provided patch addresses this by introducing a new analysis step that tracks all declared appenders. The key change is in ch.qos.logback.core.model.processor.AppenderRefModelHandler.attachReferencedAppenders. Before the patch, this function would resolve the appender reference and pass it down the chain, eventually triggering the dangerous instantiation behavior if the appender was not found. The patch adds a crucial check at the beginning of this function to verify that the referenced appender has been explicitly declared in the configuration. If it's not declared, the process is aborted with a warning, effectively preventing the code path that leads to arbitrary class instantiation. Supporting changes were made in ch.qos.logback.core.model.processor.DefaultProcessor to correctly handle the new declaration state during dependency resolution. Therefore, any runtime profile of an exploit would show activity within the logback configuration parsing, specifically involving the handling of appender-ref models.

Vulnerable functions

ch.qos.logback.core.model.processor.AppenderRefModelHandler.attachReferencedAppenders

logback-core/src/main/java/ch/qos/logback/core/model/processor/AppenderRefModelHandler.java

This function is responsible for processing `<appender-ref>` elements in a logback configuration file. It resolves the `ref` attribute, which can involve property substitution. Prior to the patch, if the resolved `ref` value did not correspond to a declared appender, the underlying machinery would attempt to interpret this value as a class name and instantiate it. An attacker with control over the configuration (or properties used in it) could leverage this to instantiate arbitrary classes on the classpath, leading to code execution. The patch mitigates this by adding a check to ensure the appender is declared before any further processing, thus preventing the instantiation of undeclared components.

ch.qos.logback.core.model.processor.DefaultProcessor.allDependenciesStarted

logback-core/src/main/java/ch/qos/logback/core/model/processor/DefaultProcessor.java

This function is part of the model processing logic and checks if all dependencies for a given model have been started. It was modified as part of the security fix to integrate the new concept of 'declared' appenders. While not the primary vulnerable function, its previous behavior was insufficient to prevent the vulnerability. The change ensures that the processor correctly handles dependencies on appenders, ignoring references to undeclared (and potentially malicious) components. This function would be on the stack during the configuration processing phase where the vulnerability could be triggered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.