CVE-2026-7303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7303", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-28T11:45:02.447Z", "datePublished": "2026-04-28T19:00:17.015Z", "dateUpdated": "2026-04-29T13:11:38.122Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-28T19:00:17.015Z"}, "title": "Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-99", "lang": "en", "description": "Improper Control of Resource Identifiers"}]}], "affected": [{"vendor": "Xuxueli", "product": "xxl-job", "versions": [{"version": "3.3.0", "status": "affected"}, {"version": "3.3.1", "status": "affected"}, {"version": "3.3.2", "status": "affected"}, {"version": "3.4.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*"], "modules": ["Execution Log Handler"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-28T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-28T13:50:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "larlarua (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/359959", "name": "VDB-359959 | Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359959/cti", "name": "VDB-359959 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/803075", "name": "Submit #803075 | xuxueli https://github.com/xuxueli/xxl-job v3.3.2 Authorization Bypass", "tags": ["third-party-advisory"]}, {"url": "https://github.com/xuxueli/xxl-job/issues/3936", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/xuxueli/xxl-job/commit/d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a", "tags": ["patch"]}, {"url": "https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0", "tags": ["patch"]}, {"url": "https://github.com/xuxueli/xxl-job/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-29T13:10:12.102358Z", "id": "CVE-2026-7303", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:11:38.122Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7303", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-29T13:10:12.102358Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:10:20.470Z"}}], "cna": {"tags": ["x_open-source"], "title": "Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection", "credits": [{"lang": "en", "type": "reporter", "value": "larlarua (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*"], "vendor": "Xuxueli", "modules": ["Execution Log Handler"], "product": "xxl-job", "versions": [{"status": "affected", "version": "3.3.0"}, {"status": "affected", "version": "3.3.1"}, {"status": "affected", "version": "3.3.2"}, {"status": "unaffected", "version": "3.4.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-28T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-28T13:50:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359959", "name": "VDB-359959 | Xuxueli xxl-job Execution Log JobLogController.java logDetailCat resource injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359959/cti", "name": "VDB-359959 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/803075", "name": "Submit #803075 | xuxueli https://github.com/xuxueli/xxl-job v3.3.2 Authorization Bypass", "tags": ["third-party-advisory"]}, {"url": "https://github.com/xuxueli/xxl-job/issues/3936", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/xuxueli/xxl-job/commit/d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a", "tags": ["patch"]}, {"url": "https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0", "tags": ["patch"]}, {"url": "https://github.com/xuxueli/xxl-job/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-99", "description": "Improper Control of Resource Identifiers"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-28T19:00:17.015Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7303", "state": "PUBLISHED", "dateUpdated": "2026-04-29T13:11:38.122Z", "dateReserved": "2026-04-28T11:45:02.447Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-28T19:00:17.015Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*"], "modules": ["Execution Log Handler"], "product": "xxl-job", "vendor": "Xuxueli", "versions": [{"status": "affected", "version": "3.3.0"}, {"status": "affected", "version": "3.3.1"}, {"status": "affected", "version": "3.3.2"}, {"status": "unaffected", "version": "3.4.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad de seguridad en Xuxueli xxl-job hasta la versi\u00f3n 3.3.2. Se ve afectada la funci\u00f3n logDetailCat del archivo xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java del componente Gestor de Registros de Ejecuci\u00f3n. La manipulaci\u00f3n del argumento logId resulta en un control inadecuado de los identificadores de recursos. El ataque puede realizarse de forma remota. Este ataque se caracteriza por una complejidad alta. La explotabilidad se considera dif\u00edcil. El exploit ha sido liberado al p\u00fablico y puede ser utilizado para ataques. Se recomienda actualizar a la versi\u00f3n 3.4.0 para solucionar este problema. El parche se identifica como d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. Se sugiere actualizar el componente afectado."}], "id": "CVE-2026-7303", "lastModified": "2026-07-24T08:10:00.150", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7303", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-29T13:10:12.102358Z", "version": "2.0.3"}}]}, "published": "2026-04-28T22:16:50.720", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/xuxueli/xxl-job/"}, {"source": "cna@vuldb.com", "url": "https://github.com/xuxueli/xxl-job/commit/d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a"}, {"source": "cna@vuldb.com", "url": "https://github.com/xuxueli/xxl-job/issues/3936"}, {"source": "cna@vuldb.com", "url": "https://github.com/xuxueli/xxl-job/releases/tag/v3.4.0"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/803075"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359959"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359959/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-99"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.3.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.4.0"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "xxl-job", "source": "cna", "vendor": "Xuxueli"}, "product": "xxl-job", "vendor": "xuxueli"}], "analysis": {"en": {"generated_at": "2026-04-29T01:18:32.709298+00:00", "value": {"mitigation_remediation": ["Upgrade Xuxueli xxl-job to version 3.4.0 or later to apply the vendor patch", "If an upgrade is not possible immediately, implement input validation on the logId parameter to ensure only numeric identifiers within the allowed range are accepted", "Continuously monitor job logs and access controls for anomalous activity, and apply least\u2011privilege principles to the components handling execution logs"], "summary": {"action": "Patch", "impact": "Remote Resource Disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is Xuxueli xxl-job, version 3.3.2 and earlier. The vulnerability is present in the execution log handling component, specifically the logDetailCat method within the JobLogController. Versions 3.4.0 and later contain the vendor\u2011supplied fix. No other vendors or components are listed as impacted.", "description_and_impact": "The flaw in the JobLogController logDetailCat endpoint allows an attacker to craft a logId value that bypasses the intended resource constraints, giving the actor control over which log entries or underlying files the application loads. Because the vulnerability can be triggered from a remote interface and the patch for this issue has already been released to the public, an exploitation attempt could result in the disclosure of sensitive data or the execution of arbitrary commands if the log files contain executable content. The CVE report states that the attack requires high complexity but is considered difficult to execute, indicating that significant expertise and precise input manipulation are required to successfully exploit the flaw.", "risk_and_exploitability": "The CVSS base score for this issue is 6.3, reflecting a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The official advisory notes that the exploit has been released publicly, but the high complexity and difficulty of exploitation mean that attacks would likely be targeted and high\u2011value. Nonetheless, the potential for unauthorized access to internal resources warrants immediate attention."}}}}, "created": "2026-04-29T00:30:15.869425+00:00", "updated": "2026-04-29T01:30:06.145233+00:00", "vendors": ["xuxueli", "xuxueli$PRODUCT$xxl-job"]}