PT-2026-35824 · Xuxueli · Xxl-Job

Larlarua · Published 2026-04-28 · Updated 2026-04-29 · CVE-2026-7303

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.4.0

Description A security flaw exists in the Execution Log Handler component within the logDetailCat() function of the JobLogController.java file. Remote manipulation of the logId argument leads to improper control of resource identifiers. This issue is characterized by high complexity and difficult exploitability.

Recommendations Upgrade to version 3.4.0. As a temporary workaround, restrict access to the logDetailCat() function to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-99

Related Identifiers

CVE-2026-7303

GHSA-GW2X-MFWR-H46P

Affected Products

Xxl-Job

References · 10

• 🔥 https://github.com/xuxueli/xxl-job/issues/3936 · Exploit
• https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0 · Patch
• https://github.com/xuxueli/xxl-job/commit/d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7303 · Security Note
• https://osv.dev/vulnerability/GHSA-gw2x-mfwr-h46p · Vendor Advisory
• https://github.com/xuxueli/xxl-job · Note
• https://vuldb.com/vuln/359959 · Note
• https://vuldb.com/submit/803075 · Note
• https://vuldb.com/vuln/359959/cti · Note
• https://twitter.com/CVEnew/status/2049227487654142309 · Twitter Post