The flaw in QOS.CH’s Logback core lies in its handling of conditional configuration files. Classified as CWE‑20 (Improper Input Validation), the vulnerability allows an attacker who can write or influence a Logback configuration to embed arbitrary Java code. The embedded code is compiled by the Janino library and executed by the running Java process, bypassing the protections that were introduced for CVE‑2025‑11226 and enabling arbitrary code execution within the application’s security context.

All Java applications that incorporate QOS.CH Sarl:Logback‑core version 1.5.34 or earlier and are also built with the Janino library on their class path are affected. The vulnerability is exploitable in environments where the attacker has write access to the Logback configuration file or can inject an environment variable that points to a malicious configuration file. Organizations using any publicly released QOS.CH Sarl:Logback‑core 1.5.34 or earlier release are therefore impacted.

The vulnerability receives a CVSS score of 7, indicating high severity, but the EPSS score is not available, so the probability of exploitation is unknown. The flaw requires the presence of Janino, the ability to write to a configuration file, or to inject a malicious environment variable, and basic privileges on the target system. Because it leads to arbitrary code execution, the risk to confidentiality, integrity, and availability is high. The flaw is not listed in the CISA KEV catalog, but it has been publicly disclosed by the vendor as a serious issue.