TI-2026-06410 Aliases CVE-2026-7303 GHSA-gw2x-mfwr-h46p

Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection

MEDIUM 61CWE-99Published 2026-04-28 · Updated 2026-04-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00419 36th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed xxl-job (Xuxueli): 3.4.0com.xuxueli:xxl-job-admin (Maven): 3.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Xuxueli	xxl-job	3.3.0; 3.3.1; 3.3.2	3.4.0	Patch available	CNA
—	com.xuxueli:xxl-job-admin (Maven)	before 3.4.0	3.4.0	Patch available	GHSA-gw2x-mfwr-h46p

xxl-job VendorXuxueli Affected 3.3.0; 3.3.1; 3.3.2 Fixed in 3.4.0 Patch available CNA
com.xuxueli:xxl-job-admin (Maven) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-gw2x-mfwr-h46p

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:xuxueli:xxl-job::::::::	—	—	Xuxueli

cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:* Versions — — ·Xuxueli

Remediation

Fix · CNA xxl-job (Xuxueli) Fixed in 3.4.0
Fix · GHSA-gw2x-mfwr-h46p com.xuxueli:xxl-job-admin (Maven) Fixed in 3.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-7303
2026-10-03 Alias added: GHSA-gw2x-mfwr-h46p
2026-10-06 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

https://github.com/xuxueli/xxl-job/issues/3936

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-7303

Other 2

TI-2022-19486 XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. CVSS 3.1CRITICAL 9.8
TI-2024-03150 Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection CVSS 3.1CRITICAL 9.8
TI-2024-28580 Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute… CVSS 3.1HIGH 8.8
TI-2024-16006 xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes… CVSS 3.1HIGH 8.8
TI-2023-16685 A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute… CVSS 3.1HIGH 8.8
TI-2022-21069 XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component… CVSS 3.1HIGH 8.8

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences