CVE-2026-25733
MEDIUM EPSS 17.3%
Published Feb 25, 20264mo ago · Modified Jun 17, 20262w ago
5.4 CVSS 3.1
Published Feb 25, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago
Description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
17.3% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 2
CWE-1004
CWE-79 Cross-site Scripting Injection
Affected Products 3
References 5
- cheatsheetseries.owasp.org https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- github.com https://github.com/rucio/rucio/releases/tag/35.8.3
- github.com https://github.com/rucio/rucio/releases/tag/38.5.4
- github.com https://github.com/rucio/rucio/releases/tag/39.3.1
- github.com https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.