CVE-2026-25733 (GCVE-0-2026-25733)

Vulnerability from cvelistv5 – Published: 2026-02-25 19:30 – Updated: 2026-02-26 16:02
VLAI
Title
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
Summary
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag
Assigner
References
Impacted products
Vendor Product Version
rucio rucio Affected: < 35.8.3
Affected: >= 36.0.0rc1, < 38.5.4
Affected: >= 39.0.0rc1, < 39.3.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25733",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T16:02:25.355565Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:02:31.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rucio",
          "vendor": "rucio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 35.8.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 36.0.0rc1, \u003c 38.5.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 39.0.0rc1, \u003c 39.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1004",
              "description": "CWE-1004: Sensitive Cookie Without \u0027HttpOnly\u0027 Flag",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T19:44:14.399Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q"
        },
        {
          "name": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
        },
        {
          "name": "https://github.com/rucio/rucio/releases/tag/35.8.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rucio/rucio/releases/tag/35.8.3"
        },
        {
          "name": "https://github.com/rucio/rucio/releases/tag/38.5.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rucio/rucio/releases/tag/38.5.4"
        },
        {
          "name": "https://github.com/rucio/rucio/releases/tag/39.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rucio/rucio/releases/tag/39.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-rwj9-7j48-9f7q",
        "discovery": "UNKNOWN"
      },
      "title": "Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25733",
    "datePublished": "2026-02-25T19:30:55.695Z",
    "dateReserved": "2026-02-05T16:48:00.427Z",
    "dateUpdated": "2026-02-26T16:02:31.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-25733",
      "date": "2026-07-03",
      "epss": "0.0026",
      "percentile": "0.1733"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-25733\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-02-25T20:23:47.717\",\"lastModified\":\"2026-06-17T10:25:07.843\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.\"},{\"lang\":\"es\",\"value\":\"Rucio es un framework de software que proporciona funcionalidad para organizar, gestionar y acceder a grandes vol\u00famenes de datos cient\u00edficos utilizando pol\u00edticas personalizables. Las versiones anteriores a la 35.8.3, 38.5.4 y 39.3.1 tienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la funci\u00f3n de Reglas Personalizadas de la WebUI donde la entrada controlada por el atacante es persistida por el backend y luego renderizada en la WebUI sin una codificaci\u00f3n de salida adecuada. Esto permite la ejecuci\u00f3n arbitraria de JavaScript en el contexto de la WebUI para los usuarios que ven las p\u00e1ginas afectadas, lo que podr\u00eda permitir el robo de tokens de sesi\u00f3n o acciones no autorizadas. Las versiones 35.8.3, 38.5.4 y 39.3.1 solucionan el problema.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"rucio\",\"product\":\"rucio\",\"versions\":[{\"version\":\"\u003c 35.8.3\",\"status\":\"affected\"},{\"version\":\"\u003e= 36.0.0rc1, \u003c 38.5.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 39.0.0rc1, \u003c 39.3.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-02-26T16:02:25.355565Z\",\"id\":\"CVE-2026-25733\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-1004\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"35.8.3\",\"matchCriteriaId\":\"3BCD5122-895C-41F6-8DDE-5DD999D88FDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"36.0.0\",\"versionEndExcluding\":\"38.5.4\",\"matchCriteriaId\":\"364DE7B4-B341-4A96-917B-B2D37777CB7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"39.0.0\",\"versionEndExcluding\":\"39.3.1\",\"matchCriteriaId\":\"EB66BA62-B3B2-45C5-99AC-59CC9B39F350\"}]}]}],\"references\":[{\"url\":\"https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/rucio/rucio/releases/tag/35.8.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/rucio/rucio/releases/tag/38.5.4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/rucio/rucio/releases/tag/39.3.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.