Vulnerability in Apache Log4cxx
CVE-2025-54812
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user. In order to activate this, the following sequence must occur: * Log4cxx is configured to use HTMLLayout. * Logger name comes from an untrusted string * Logger with compromised name logs a message * User opens the generated HTML log file in their browser, leading to potential XSS Because logger names are generally constant strings, we assess the impact to users as LOW This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
EPSS: 0.012 (64.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Apache Log4cxx
- Apache Software Foundation Log4cxx — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Vendor Advisory)
- security@apache.org (Patch, patch, Issue Tracking)
- security@apache.org (Patch, patch, Issue Tracking)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-54812?
- CVE-2025-54812 is a medium-severity vulnerability in Apache Log4cxx, classified under Improper Output Neutralization for Logs. CVSS score: 5.4/10. Published 2025-08-22.
- How severe is CVE-2025-54812?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2025-54812 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.