This vulnerability (CVE-2026-13006) affects QOS.CH Sarl Logback-core versions up to and including 1.5.36. It arises from improper input validation (CWE-20) in the conditional processing of configuration files, which can be exploited by an attacker who has write access to a logback configuration file or can inject a malicious environment variable before program execution. The presence of the Janino library on the class path is required for exploitation. The vulnerability enables arbitrary code execution, circumventing protections implemented for a previous vulnerability (CVE-2025-11226). The issue was mitigated in version 1.5.37 by removing the conditional processing feature that relied on Janino.

An attacker with existing high privileges and write access to configuration files or the ability to inject environment variables can execute arbitrary code within the affected Java application. This can lead to compromise of the application integrity and potentially the host system. The vulnerability requires the Janino library to be present, which is a prerequisite for exploitation. There are no known exploits in the wild at this time.

Upgrade to Logback-core version 1.5.37 or later, where conditional processing using Janino has been removed, effectively mitigating this vulnerability. Since no official patch or temporary fix is listed, the vendor's removal of the vulnerable feature in 1.5.37 is the recommended remediation. Ensure that only trusted users have write access to configuration files and environment variables to reduce risk.