Stored XSS Vulnerability in Rucio WebUI Affects Multiple Versions
CVE-2026-25733
7.3HIGH
What is CVE-2026-25733?
Rucio, a framework designed for managing scientific data, has a vulnerability affecting its WebUI where user inputs can be maliciously stored and later executed as JavaScript. This occurs in the Custom Rules function, leading to potential security breaches. Users viewing the compromised pages may face risks such as session token theft and unauthorized actions within the application. Versions 35.8.3, 38.5.4, and 39.3.1 address this security issue.
Affected Version(s)
rucio < 35.8.3 < 35.8.3
rucio >= 36.0.0rc1, < 38.5.4 < 36.0.0rc1, 38.5.4
rucio >= 39.0.0rc1, < 39.3.1 < 39.0.0rc1, 39.3.1