GitHub Advisoryadvisory · Maven

GHSA-6rq7-m52p-8pqg xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key

LOW Published 2025-08-21 Modified 2026-05-07 Official page ↗
Aliases
CVE-2025-9263
Ecosystem
Maven
Packages
com.xuxueli:xxl-job-admin
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639, CWE-99
Reviewed
2026-05-07

Affected packages

• Maven com.xuxueli:xxl-job-admin: < 3.2.0 → fixed in 3.2.0

Description

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-9263 A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. vulnerability

Weakness · CWE (2)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness
  • CWE-99 Improper Control of Resource Identifiers weakness

References