Stored Cross-Site Scripting Vulnerability in Rucio WebUI
CVE-2026-25736
6.1MEDIUM
What is CVE-2026-25736?
Rucio is a software framework designed for managing large volumes of scientific data through customizable policies. A stored Cross-Site Scripting vulnerability exists in the Custom RSE Attribute of the WebUI for versions prior to 35.8.3, 38.5.4, and 39.3.1. This vulnerability allows an attacker to inject malicious input that is stored by the backend. When users interact with affected pages, this input is rendered without proper output encoding, exposing them to arbitrary JavaScript execution. This can result in session token theft or unauthorized actions within the application context.
Affected Version(s)
rucio < 35.8.3 < 35.8.3
rucio >= 36.0.0rc1, < 38.5.4 < 36.0.0rc1, 38.5.4
rucio >= 39.0.0rc1, < 39.3.1 < 39.0.0rc1, 39.3.1