CVE-2026-7305

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-7305

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7305.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-7305

Published

2026-04-28T19:15:13.287Z

Modified

2026-07-15T01:49:15.326611116Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery

Details

A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. There is ongoing doubt regarding the real existence of this vulnerability. The project maintainer explains (translated from Chinese): "Triggers are manually activated and involve login and access control, thus requiring management." The pull request by the researcher got rejected because of that.

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "isDisputed": true,
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7305.json"
}

References

Affected packages

Git / github.com/xuxueli/xxl-job

Affected ranges

Type

GIT

Repo

https://github.com/xuxueli/xxl-job

Events

Introduced

780dcf7c40133ce92fbaf653611fba897a60fad6

Last affected

5658650fdb7b00bc0f44141f0aa9b772d65190f9

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "last_affected": "3.3.0"
        },
        {
            "introduced": "3.3.1"
        },
        {
            "last_affected": "3.3.1"
        },
        {
            "introduced": "3.3.2"
        },
        {
            "last_affected": "3.3.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

3.*

3.3.0

3.3.1

3.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7305.json"