CVE-2026-25735: Rucio WebUI Stored XSS Vulnerability in Identity Name
Summary
CVE-2026-25735: Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name. Affects rucio-webui across 3 version ranges.
< 35.8.3
>= 36.0.0rc1, < 38.5.4
>= 39.0.0rc1, < 39.3.1
Fixed in 35.8.3, 38.5.4 or 39.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rucio WebUI is a web-based interface for managing data in distributed storage systems. It allows users to manage accounts, identities, and data transfers. The application is designed to facilitate data management in high-energy physics and other scientific fields. However, it has a vulnerability that allows for stored Cross-site Scripting (XSS) attacks, which can compromise user sessions and data integrity.
Vulnerability Detail
A stored Cross-site Scripting (XSS) vulnerability exists in the Identity Name field of the Rucio WebUI. This vulnerability arises from the backend persisting attacker-controlled input without proper output encoding. When users view affected pages, arbitrary JavaScript can be executed in their browsers, leading to potential session token theft and unauthorized actions. The vulnerability can be exploited by sending a specially crafted payload to the Identity Name field, which is then stored and rendered without sanitization.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 35.8.335.8.3pip install --upgrade "rucio-webui==35.8.3" -
>= 36.0.0rc1, < 38.5.438.5.4pip install --upgrade "rucio-webui==38.5.4" -
>= 39.0.0rc1, < 39.3.139.3.1pip install --upgrade "rucio-webui==39.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that all user-controlled data is properly sanitized before rendering it in the WebUI. Avoid using unsafe methods like .html() for inserting content into the DOM. Instead, use safer alternatives such as .text() or create text nodes.
Conclusion
The Rucio WebUI has a stored XSS vulnerability that can lead to serious security issues for users. It is crucial to update to the latest patched versions to mitigate the risk. Proper sanitization of user inputs is also essential to prevent such vulnerabilities in the future.
See every vulnerability recorded for rucio-webui →
FAQ
The vulnerability is a stored Cross-site Scripting (XSS) issue that allows attackers to execute arbitrary JavaScript in the context of the WebUI.
Any authenticated user who views affected resources in the Rucio WebUI may be impacted by this vulnerability.
Attackers can steal session tokens, perform unauthorized actions, or create new user identities with known passwords.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
