The flaw in the JobLogController logDetailCat endpoint allows an attacker to craft a logId value that bypasses the intended resource constraints, giving the actor control over which log entries or underlying files the application loads. Because the vulnerability can be triggered from a remote interface and the patch for this issue has already been released to the public, an exploitation attempt could result in the disclosure of sensitive data or the execution of arbitrary commands if the log files contain executable content. The CVE report states that the attack requires high complexity but is considered difficult to execute, indicating that significant expertise and precise input manipulation are required to successfully exploit the flaw.

The affected product is Xuxueli xxl-job, version 3.3.2 and earlier. The vulnerability is present in the execution log handling component, specifically the logDetailCat method within the JobLogController. Versions 3.4.0 and later contain the vendor‑supplied fix. No other vendors or components are listed as impacted.

The CVSS base score for this issue is 6.3, reflecting a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The official advisory notes that the exploit has been released publicly, but the high complexity and difficulty of exploitation mean that attacks would likely be targeted and high‑value. Nonetheless, the potential for unauthorized access to internal resources warrants immediate attention.