XXL-JOB CVE-2026-106706

Exploitation requires an authenticated XXL-JOB admin console account with privileges to create or edit GLUE-mode jobs (PR:L), since the payload is injected through the glueSource parameter handled by JobCodeController.save(). The stored script fires only when another authenticated user - typically an administrator - subsequently opens the job's GLUE code view rendered by the job.code.ftl template (UI:R). Limiting factors: no anonymous/unauthenticated path exists, the attack is inert until a victim views the specific job code page, and impact is confined to the browser session of that viewer (no direct server compromise from the XSS itself). Default deployments are affected because the vulnerable code lacks output encoding regardless of configuration.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) is internally consistent with a stored XSS flaw: network-reachable but gated behind both authentication (PR:L - an attacker must already hold an account able to save GLUE job code) and victim interaction (UI:R - another user must open the affected page). The scope change (S:C) correctly reflects script executing in a victim's browser authority rather than the server's. No EPSS score, CISA KEV listing, or published proof-of-concept exploit is present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict to reconcile - all indicators point the same direction (medium severity, no known exploitation). The one escalation concern NOT captured by the base score: XXL-JOB's admin console can schedule and execute arbitrary GLUE tasks on worker nodes, so a hijacked administrator session could be leveraged toward code execution - the C:L/I:L rating understates this chained potential. Treat as a patch-in-normal-cycle item, elevated if the admin console is exposed to multiple or lower-trust users.

An attacker holding a low-privileged XXL-JOB admin console account that can create or edit GLUE jobs saves a job whose glueSource field contains a JavaScript payload. Because JobCodeController.save() stores the value without encoding and the job.code.ftl FreeMarker template renders it unescaped, the script executes when an administrator later opens that job's code view, potentially stealing the admin session. No public exploit code was identified in the provided data.