CVE-2026-25733: Cern Rucio cross-site scripting (XSS) (CVSS 7.3)

Description

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

Cern Rucio≥ 36.0.0 < 38.5.4 · ≥ 39.0.0 < 39.3.1 · < 35.8.3

Remediation

Fixed in

Cern Rucio≥ 38.5.4

Patch & vendor advisories

https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q

References

https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.htmlNot Applicable
https://github.com/rucio/rucio/releases/tag/35.8.3ProductRelease Notes
https://github.com/rucio/rucio/releases/tag/38.5.4ProductRelease Notes
https://github.com/rucio/rucio/releases/tag/39.3.1ProductRelease Notes
https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7qExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-25733 being actively exploited?

CVE-2026-25733 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.41%.

How severe is CVE-2026-25733?

CVE-2026-25733 has a CVSS 3.1 base score of 7.3, rated high. EPSS estimates a 0.41% probability of exploitation.

Which products are affected by CVE-2026-25733?

Affected products include Cern Rucio.

How do I fix CVE-2026-25733?

Upgrade affected software to a fixed version, for example Cern Rucio 38.5.4 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-25733 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo