CVE-2026-25734

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Published Feb 25, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

Analysis

Technical impact

Versions of Rucio before 35.8.3, 38.5.4, and 39.3.1 contain a stored cross‑site scripting flaw in the handling of RSE metadata within the WebUI. The flaw allows attacker‑controlled input to be persisted by the backend and subsequently rendered without proper output encoding, enabling the execution of arbitrary JavaScript in the context of users who view the affected pages. This could be used to steal session tokens or perform unauthorized actions on behalf of the user.

Affected Systems

The vulnerability affects any installation of Rucio through its primary WebUI, specifically versions earlier than 35.8.3, 38.5.4, and 39.3.1. Users running those legacy releases are at risk if they allow arbitrary RSE metadata to be stored and displayed.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no exploits are currently known. An attacker would need to inject malicious payloads into RSE metadata and then persuade or force a legitimate user to view the modified page, after which the injected JavaScript would execute in the victim’s browser session.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rucio

affected

Version	Status	Constraints
`< 35.8.3`	affected	—
`>= 36.0.0rc1, < 38.5.4`	affected	—
`>= 39.0.0rc1, < 39.3.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:cern:rucio::::::::
	cpe:2.3:a:cern:rucio::::::::
	cpe:2.3:a:cern:rucio::::::::

No data.

Vendor Product Versions

Rucio

Version	Status	Scheme	Platform
`[0,35.8.3)`	affected	semver	—
`[36.0.0rc1,38.5.4)`	affected	semver	—
`[39.0.0rc1,39.3.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Rucio to at least version 35.8.3, 38.5.4, or 39.3.1, which contain the fix for the stored cross‑site scripting issue.
If an immediate upgrade is not possible, ensure that any existing RSE metadata entries are reviewed and sanitized so that no script tags or executable code remain stored.
Implement output encoding for the RSE metadata fields in the WebUI as a temporary defensive measure, and consider deploying a Web Application Firewall rule to block requests containing suspicious script payloads.

Generated by OpenCVE AI on April 17, 2026 at 14:58 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-h9fp-p2p9-873q	Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.338% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
https://github.com/rucio/rucio/releases/tag/35.8.3
https://github.com/rucio/rucio/releases/tag/38.5.4
https://github.com/rucio/rucio/releases/tag/39.3.1
https://github.com/rucio/rucio/security/advisories/GHSA-h9fp-p2p9-873q

History

Feb 28, 2026 4:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 27, 2026 7:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cern Cern rucio
CPEs		cpe:2.3:a:cern:rucio::::::::
Vendors & Products		Cern Cern rucio

Feb 26, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rucio Rucio rucio
Vendors & Products		Rucio Rucio rucio

Feb 25, 2026 8:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the RSE metadata of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Title		Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata
Weaknesses		CWE-1004 CWE-79
References		https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html https://github.com/rucio/rucio/releases/tag/35.8.3 https://github.com/rucio/rucio/releases/tag/38.5.4 https://github.com/rucio/rucio/releases/tag/39.3.1 https://github.com/rucio/rucio/security/advisories/GHSA-h9fp-p2p9-873q
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N'}`