Server-Side Request Forgery Vulnerability in Xuxueli XXL-Job by Xuxueli
CVE-2026-7305
Key Information:
Badges
What is CVE-2026-7305?
A vulnerability has been detected in the XXL-Job project by Xuxueli affecting version 3.3.2. The issue lies within the triggerJob function in the XxlJobServiceImpl.java file. This weakness allows the manipulation of the addressList argument, which can lead to server-side request forgery (SSRF) attacks. Although there are claims regarding the exploitation feasibility, the project maintainer stated that triggers require manual activation, including login and access controls. Thus, the potential impact may be limited, and prior exploitation of this vulnerability would necessitate specific access permissions. However, the exploit code is publicly available, raising concerns about potential misuse.
Affected Version(s)
xxl-job 3.3.0
xxl-job 3.3.1
xxl-job 3.3.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved