CVE-2025-54812: Apache Log4cxx XSS Vulnerability

CVE-2025-54812 Overview

CVE-2025-54812 is an Improper Output Neutralization for Logs vulnerability [CWE-117] affecting Apache Log4cxx before version 1.5.0. The flaw exists in the HTMLLayout component, which fails to properly escape logger names when writing entries to HTML log files. An attacker who controls a logger name derived from untrusted input can inject HTML or JavaScript that executes when an operator opens the generated log file in a browser. The Apache Logging Services project rates the practical impact as LOW because logger names are typically constant strings defined at compile time.

Critical Impact
Successful exploitation enables cross-site scripting (XSS) in HTML log viewers, allowing attackers to conceal log entries or exfiltrate data from analysts reviewing logs.

Affected Products

Apache Log4cxx versions prior to 1.5.0
Applications embedding Log4cxx with HTMLLayout configured
Debian LTS packages shipping vulnerable Log4cxx builds

Discovery Timeline

2025-08-22 - CVE CVE-2025-54812 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54812

Vulnerability Analysis

The vulnerability resides in the HTMLLayout class of Apache Log4cxx. When this layout formats a log event into HTML, it writes the logger name directly into the output document without escaping HTML metacharacters. An attacker who can influence the logger name — for example, through a code path that derives it from user input — can embed arbitrary HTML tags or <script> blocks in the log file.

The payload only triggers when an operator opens the generated HTML log file in a browser. At that point, the injected content is parsed by the browser, enabling script execution in the local file or origin context. Attackers can leverage this to hide legitimate log entries with CSS, tamper with displayed values, or exfiltrate log contents to a remote endpoint. The exploitation chain requires four conditions to align: HTMLLayout configuration, an untrusted logger name, at least one log call using that logger, and an operator viewing the output HTML.

Root Cause

The root cause is missing output neutralization in the HTML rendering path of HTMLLayout. The layout treats logger names as trusted, safe strings and writes them verbatim into an HTML context. Log4cxx developers addressed this in GitHub Pull Request #509 and GitHub Pull Request #514 by applying proper HTML entity encoding to logger name output.

Attack Vector

Exploitation requires an application path that constructs a log4cxx::Logger using an attacker-influenced name and then emits a log record. The attacker embeds HTML or JavaScript within the logger name string. When the resulting HTML log file is opened by an analyst, the browser renders and executes the injected payload. Because logger names are almost always compile-time constants, the vulnerable pattern is uncommon in production code. See the Apache Security Advisory CVE-2025-54812 for full advisory details.

Detection Methods for CVE-2025-54812

Indicators of Compromise

HTML log files containing <script>, <iframe>, or event-handler attributes (for example onerror=, onload=) inside logger name fields
Outbound network connections initiated from a browser after opening a Log4cxx HTML log file
Log entries where the logger name column contains HTML tags or entity-encoded payloads that were not applied by the layout itself

Detection Strategies

Inventory applications linking against apache:log4cxx and identify configurations that specify HTMLLayout in log4cxx.xml or log4cxx.properties
Grep source code for getLogger() calls that accept variables sourced from network input, HTTP headers, or user-provided identifiers
Scan existing HTML log archives for angle brackets or script tags appearing in logger name positions

Monitoring Recommendations

Alert on modifications to Log4cxx configuration files that introduce or retain HTMLLayout
Monitor endpoints that render local HTML log files for anomalous outbound web requests from browser processes
Track deployment of Log4cxx binaries and flag versions below 1.5.0 in software composition analysis tooling

How to Mitigate CVE-2025-54812

Immediate Actions Required

Upgrade Apache Log4cxx to version 1.5.0 or later, which applies HTML entity encoding to logger names
Audit application code and remove any pattern that constructs logger names from untrusted input
Review existing HTML log archives for injected markup before opening them in a browser

Patch Information

The fix is included in Apache Log4cxx 1.5.0. The corrective code changes are tracked in GitHub Pull Request #509 and GitHub Pull Request #514. Downstream distribution updates are documented in the Debian LTS Announcement and the Openwall OSS Security Discussion.

Workarounds

Switch the appender layout from HTMLLayout to PatternLayout or JSONLayout until upgrading is possible
View log files in a plain text editor rather than a web browser to prevent script execution
Enforce a strict allowlist for logger name values when they must be constructed dynamically

bash

# Configuration example: replace HTMLLayout with PatternLayout in log4cxx.xml
# <layout class="HTMLLayout"/>   <-- vulnerable
<layout class="PatternLayout">
    <param name="ConversionPattern" value="%d [%t] %-5p %c - %m%n"/>
</layout>