CVE-2026-7305 Xuxueli CVE debrief

Who should care

Users of Xuxueli xxl-job up to version 3.3.2 should be aware of this server-side request forgery vulnerability and take necessary precautions to protect their systems, including reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The vulnerability is caused by a weakness in the triggerJob function of the XxlJobServiceImpl.java file in the xxl-job-admin component. The manipulation of the addressList argument leads to server-side request forgery. The attack can be initiated remotely, and the exploit has been made publicly available. Users of Xuxueli xxl-job up to version 3.3.2 should be aware of this server-side request forgery vulnerability and take necessary precautions to protect their systems.

Defensive priority

Low

Recommended defensive actions

• Inventory and verify the version of Xuxueli xxl-job in use
• Apply patches or updates if available
• Implement compensating controls to detect and prevent server-side request forgery attacks
• Monitor systems for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-28T22:16:50.893Z and was last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Deferred. There is ongoing doubt regarding the real existence of this vulnerability. The project maintainer explains (translated from Chinese): 'Triggers are manually activated and involve login and access control, thus requiring management.'

Official resources