StackRadar

CVE-2025-11226

Medium

Advisory

Published 1 Oct 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
440
of 17,781 indexed, latest versions
Container images
409
deployed by those charts
Fix available
1 of 1
affected package

QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing

Carried by container images the latest versions of 440 of 17,781 indexed charts deploy, on 409 images.

Affected packageAffected versionsFixed inImages
logback-coremaven1.0.11, 1.0.13, 1.1.2, 1.1.3+34 more1.3.16, 1.5.19409
OSV records
GHSA-25qh-j22f-pwp8

Charts affected

440 by stars
ChartLatestAffected imagesRadar Score
mod-ldpfolio-org0.1.331 of 1See more

mod-ldp folio-org 0.1.33

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
folioci/mod-ldp:latestb55696fd9065
logback-core@1.4.14
1.5.19

Open the chart page →

1,938
mod-licensesfolio-org0.1.321 of 1See more

mod-licenses folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
folioci/mod-licenses:latestcfd6109bf477
logback-core@1.2.13
1.3.16

Open the chart page →

1,760
mod-marccatfolio-org0.1.301 of 1See more

mod-marccat folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
folioci/mod-marccat:latest1b57d690d568
logback-core@1.2.3
1.3.16

Open the chart page →

6,988
mod-oafolio-org0.1.21 of 1See more

mod-oa folio-org 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
folioci/mod-oa:latestae3b069d4ba5
logback-core@1.2.13
1.3.16

Open the chart page →

1,733
mod-serials-managementfolio-org0.1.11 of 1See more

mod-serials-management folio-org 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
folioci/mod-serials-management:latest571fa1ffe8c9
logback-core@1.2.13
1.3.16

Open the chart page →

1,733
mod-service-interactionfolio-org0.1.61 of 1See more

mod-service-interaction folio-org 0.1.6

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
folioci/mod-service-interaction:latestf53c327a48e8
logback-core@1.2.13
1.3.16

Open the chart page →

1,733
guacamolegabibbo970.3.01 of 3See more

guacamole gabibbo97 0.3.0

1 of the 3 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
guacamole/guacamole:1.3.0739cb6820ae8
logback-core@1.2.3
1.3.16

Open the chart page →

6,412
pagesgary-pages1.0.01 of 3See more

pages gary-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
logback-core@1.2.3
1.3.16

Open the chart page →

20,190
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
logback-core@1.2.3
1.3.16

Open the chart page →

18,230
booksonic-airgeek-cookbookVerified publisher6.4.21 of 1See more

booksonic-air geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
logback-core@1.2.3
1.3.16

Open the chart page →

19,215
gapsgeek-cookbookVerified publisher5.4.21 of 1See more

gaps geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
housewrecker/gaps:latestf417dd0a7547
logback-core@1.2.11
1.3.16

Open the chart page →

8,943
komgageek-cookbookVerified publisher2.4.21 of 1See more

komga geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
gotson/komga:0.99.49b15ea6bfc30
logback-core@1.2.3
1.3.16

Open the chart page →

12,581
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
logback-core@1.2.3
1.3.16

Open the chart page →

17,702
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
logback-core@1.1.3
1.3.16

Open the chart page →

27,949
promcordgeek-cookbookVerified publisher5.4.21 of 1See more

promcord geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
biospheere/promcord:latest16d4fd269e66
logback-core@1.2.3
1.3.16

Open the chart page →

1,147
sharrygeek-cookbookVerified publisher5.4.21 of 1See more

sharry geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
eikek0/sharry:1.8.0661ff3ef42cd
logback-core@1.2.3
1.3.16

Open the chart page →

1,419
rocketmqgengxiankun-charts0.3.01 of 1See more

rocketmq gengxiankun-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
apache/rocketmq:5.3.0434d8398f996
logback-core@1.3.5
1.3.16

Open the chart page →

4,921
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
logback-core@1.2.3
1.3.16

Open the chart page →

34,754
jaegergpg-dev3.3.32 of 5See more

jaeger gpg-dev 3.3.3

2 of the 5 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
logback-core@1.2.9
1.3.16
library/cassandra:3.11.65aa8400b4b3b
logback-core@1.1.3
1.3.16

Open the chart page →

19,229
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
logback-core@1.2.9
1.3.16

Open the chart page →

15,722
opentsdbgradiant-bigdataVerified publisher0.1.71 of 6See more

opentsdb gradiant-bigdata 0.1.7

1 of the 6 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
gradiant/opentsdb:2.4.0c33d53913869
logback-core@1.0.13
1.3.16

Open the chart page →

17,511
supertokensgraphql-hive1.0.01 of 1See more

supertokens graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
supertokens/supertokens-postgresql:3.1418d34c781347
logback-core@1.2.3
1.3.16

Open the chart page →

2,709
siembolgresearch0.1.62 of 4See more

siembol gresearch 0.1.6

2 of the 4 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
gresearchdev/siembol-config-editor-rest:latest91863a50afb7
logback-core@1.2.11
1.3.16
gresearchdev/siembol-storm-topology-manager:latest8dad36a05ebf
logback-core@1.2.11
1.3.16

Open the chart page →

14,312
ubooquityhalkeye0.1.11 of 1See more

ubooquity halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
linuxserver/ubooquity:2.1.2-ls369932d6759112
logback-core@1.1.3
1.3.16

Open the chart page →

4,303
hapi-fhirhapi-fhirVerified publisher0.1.01 of 1See more

hapi-fhir hapi-fhir 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
logback-core@1.1.7
1.3.16

Open the chart page →

6,362
nacosheidaodageshiwoVerified publisher0.1.51 of 1See more

nacos heidaodageshiwo 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
logback-core@1.2.9
1.3.16

Open the chart page →

3,978
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
logback-core@1.5.18
1.5.19

Open the chart page →

1,417
helm-airportshelm-airports0.1.03 of 7See more

helm-airports helm-airports 0.1.0

3 of the 7 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
dina1993/airports-api:latestac731244aed1
logback-core@1.4.6
1.5.19
dina1993/airports-consumer:latest669d146a5e63
logback-core@1.4.6
1.5.19
dina1993/airports-producer:latest3d6b0dac1cb4
logback-core@1.4.6
1.5.19

Open the chart page →

12,696
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
logback-core@1.2.3
1.3.16

Open the chart page →

20,190
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
logback-core@1.2.3
1.3.16

Open the chart page →

6,451
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
dannielkil/book-backend:lateste3b479a55a69
logback-core@1.2.11
1.3.16

Open the chart page →

9,122
druidhelmforgeVerified publisher1.3.61 of 4See more

druid helmforge 1.3.6

1 of the 4 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
library/zookeeper:3.9.5f258365d4882
logback-core@1.3.15
1.3.16

Open the chart page →

8,541
zookeeperhelmforgeVerified publisher1.0.21 of 1See more

zookeeper helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
library/zookeeper:3.9.5f258365d4882
logback-core@1.3.15
1.3.16

Open the chart page →

3,103
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
logback-core@1.2.3
1.3.16

Open the chart page →

20,190
todo-apihelm-repo-sharif0.1.01 of 2See more

todo-api helm-repo-sharif 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
pavanelthepu/todo-api:1.0.2f47658e3b24c
logback-core@1.2.3
1.3.16

Open the chart page →

2,544
eoloplanthttpd-eoloplant0.1.02 of 7See more

eoloplant httpd-eoloplant 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
logback-core@1.2.7
1.3.16
codeurjc/toposervice:v1.09fb4c11e6a49
logback-core@1.4.5
1.5.19

Open the chart page →

32,205
sys-info-web-env-view-serverhuajuan-helm-charts0.1.11 of 2See more

sys-info-web-env-view-server huajuan-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
huajuan6848/env-view-server:0.0.1-SNAPSHOTa303f3d9f6e0
logback-core@1.4.8
1.5.19

Open the chart page →

1,989
prometheushuangchengwu-helm-chart0.1.01 of 3See more

prometheus huangchengwu-helm-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
apache/skywalking-ui:9.2.0295f1dc87d98
logback-core@1.2.11
1.3.16

Open the chart page →

16,401
skywalking-v1huangchengwu-helm-chart0.1.01 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
apache/skywalking-ui:8.9.180530f0308a5
logback-core@1.2.3
1.3.16

Open the chart page →

20,650
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
logback-core@1.1.11
1.3.16
ibmcom/microclimate-theia:lateste17bdccc5030
logback-core@1.1.11
1.3.16

Open the chart page →

57,669
eoloserverihuertas2021-vmartinp2021-helm0.1.02 of 7See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
logback-core@1.4.5
1.5.19
huertaslopez/i.huertas.2021-v.martinp.2021-planner:2.0.0e2c18bd65472
logback-core@1.2.7
1.3.16

Open the chart page →

27,721
ikigaiikigai-chartVerified publisher0.0.92 of 58See more

ikigai ikigai-chart 0.0.9

2 of the 58 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
dremio/dremio-oss:24.1.080ed2e3b7c43
logback-core@1.2.11
1.3.16
library/zookeeper:3.8-temurin55d1e5b2e601
logback-core@1.2.10
1.3.16

Open the chart page →

37,671
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
logback-core@1.3.14
1.3.16

Open the chart page →

5,320
itm-mqtt-brokerintelVerified publisher1.0.01 of 1See more

itm-mqtt-broker intel 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
hivemq/hivemq4:dns-4.5.144d194450d48e
logback-core@1.2.3
1.3.16

Open the chart page →

2,653
appswitcher-serverit-at-mOfficialVerified publisher2.0.21 of 1See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
logback-core@1.5.18
1.5.19

Open the chart page →

3,774
kf-app-eaiit-at-mOfficialVerified publisher0.1.71 of 1See more

kf-app-eai it-at-m 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
logback-core@1.5.18
1.5.19

Open the chart page →

1,947
zammad-ldap-syncit-at-mVerified publisher0.6.51 of 1See more

zammad-ldap-sync it-at-m 0.6.5

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
logback-core@1.5.12
1.5.19

Open the chart page →

1,345
thehiveittrident-oss0.1.02 of 6See more

thehive ittrident-oss 0.1.0

2 of the 6 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
library/cassandra:4.0093ee8ee5eb2
logback-core@1.2.9
1.3.16
thehiveproject/cortex:3.1.7f4bc64fb8844
logback-core@1.2.11
1.3.16

Open the chart page →

6,122
discord-experiencebotjfwenischVerified publisher0.7.41 of 1See more

discord-experiencebot jfwenisch 0.7.4

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/discord-experiencebot:latestb52ff07f9f0c
logback-core@1.2.11
1.3.16

Open the chart page →

7,826
steamcmd-managerjfwenischVerified publisher0.4.51 of 1See more

steamcmd-manager jfwenisch 0.4.5

1 of the 1 container images this version deploys carry CVE-2025-11226.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
logback-core@1.5.12
1.5.19

Open the chart page →

6,586

Container images carrying it

409 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
logback-core@1.2.3
1.3.16
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
logback-core@1.4.14
1.5.19
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
logback-core@1.4.14
1.5.19
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
logback-core@1.4.14
1.5.19
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
logback-core@1.4.14
1.5.19
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
logback-core@1.5.9
1.5.19
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
logback-core@1.2.12
1.3.16
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
logback-core@1.2.3
1.3.16
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
logback-core@1.5.9
1.5.19
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.