High 7.3Published Feb 25, 2026

CVE-2026-25733Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Updated under an hour ago (Oct 27, 2026, 1:40 PM ET)

Does this affect you?

It affects rucio and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for rucio

Exploited in the last 30 days

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

CVSS: 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-79, CWE-1004
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Feb 26, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

rucio rucio rucio:rucio (from the name)	before 35.8.3; from 36.0.0rc1, < 38.5.4; from 39.0.0rc1, < 39.3.1	CNA record
cern rucio cern:rucio	before 35.8.3; from 36.0.0 before 38.5.4; from 39.0.0 before 39.3.1	NVD

References

References

https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q	x-refsource-confirm, exploit, vendor-advisory
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html	x-refsource-misc, not-applicable
https://github.com/rucio/rucio/releases/tag/35.8.3	x-refsource-misc, product, release-notes
https://github.com/rucio/rucio/releases/tag/38.5.4	x-refsource-misc, product, release-notes
https://github.com/rucio/rucio/releases/tag/39.3.1	x-refsource-misc, product, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.