CVE-2005-1915: LOG4SH

Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The log4sh_readProperties function in log4sh 1.2.5 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable log4sh.$$ filenames.

Affected products

• LOG4SH LOG4SH: version 1.2.3 only; version 1.2.4 only; version 1.2.5 only

Published 2005-09-02. Last modified 2026-06-16.