A stored Cross‑Site Scripting vulnerability exists in the WebUI of Rucio when an attacker supplies malicious content in the Identity Name field. The backend saves this data without proper output encoding, and the WebUI later displays it as plain text. If an impacted user views the affected page, the injected script executes in that user’s browser, allowing the attacker to steal session cookies or perform actions on the user’s behalf.

The flaw affects the Rucio framework. Versions older than 35.8.3, 38.5.4, or 39.3.1 are vulnerable. Systems running any of those release lines, especially the default distribution from CERN, are at risk.

The CVSS score of 6.1 rates this vulnerability as medium severity. The EPSS figure indicates a very low but non‑zero probability of exploitation, and it is not listed in the CISA KEV catalog. Attackers would likely exploit the WebUI by inserting malicious code through the identity name input, then target users who subsequently view the affected pages. Successful exploitation leads to client‑side script execution, potentially compromising user sessions and allowing unauthorized actions.