CVE-2026-3733

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-3733

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3733.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-3733

Published

2026-03-08T11:02:14.508Z

Modified

2026-07-15T01:48:57.246654648Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

xuxueli xxl-job JobInfoController.java server-side request forgery

Details

A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: "Access token security verification is required." (translated from Chinese)

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3733.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/xuxueli/xxl-job

Affected ranges

Type

GIT

Repo

https://github.com/xuxueli/xxl-job

Events

Introduced

780dcf7c40133ce92fbaf653611fba897a60fad6

Last affected

5658650fdb7b00bc0f44141f0aa9b772d65190f9

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "last_affected": "3.3.0"
        },
        {
            "introduced": "3.3.1"
        },
        {
            "last_affected": "3.3.1"
        },
        {
            "introduced": "3.3.2"
        },
        {
            "last_affected": "3.3.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

3.*

3.3.0

3.3.1

3.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3733.json"