CVE-2026-13006

Name of the Vulnerable Software and Affected Versions logback-core versions prior to 1.5.35

Description An arbitrary code execution issue exists in the conditional configuration file processing of Java applications. An attacker can execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution, which bypasses protections against previous similar issues. This attack requires the Janino library to be present on the user's class path and requires the attacker to have existing privileges, such as write access to a configuration file or the ability to inject a malicious environment variable pointing to a malicious configuration file.

Recommendations Update to version 1.5.35 or later.