PT-2026-115078 · Xxl-Job · Xxl-Job
CVE-2026-106707
·
Published
2026-10-15
·
Updated
2026-10-15
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
XXL-JOB versions prior to 3.5.0-SNAPSHOT
Description
A stored Cross-Site Scripting (XSS) issue exists in the job log list page '/joblog'. An authenticated user with permissions for a target executor job group can inject arbitrary JavaScript through the
executorParam argument of the manual-trigger endpoint 'POST /jobinfo/trigger'.Recommendations
Update to a version newer than 3.5.0-SNAPSHOT.
As a temporary mitigation, restrict access to the 'POST /jobinfo/trigger' endpoint or avoid using the
executorParam argument.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xxl-Job