CVE-2026-25733: Rucio WebUI Stored XSS Vulnerability via Custom Rule Function
Summary
CVE-2026-25733: Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function. Affects rucio-webui across 3 version ranges.
< 35.8.3
>= 36.0.0rc1, < 38.5.4
>= 39.0.0rc1, < 39.3.1
Fixed in 35.8.3, 38.5.4 or 39.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rucio is an open-source software framework designed for managing and transferring large amounts of data across various storage systems. The Rucio WebUI provides a user-friendly interface for users to interact with Rucio's functionalities, including managing subscriptions and rules. However, a vulnerability has been identified in the WebUI that allows for stored Cross-site Scripting (XSS) attacks through the Custom Rules function, where user input is not properly sanitized before being rendered.
Vulnerability Detail
A stored Cross-site Scripting (XSS) vulnerability exists in the Custom Rules function of the Rucio WebUI. This vulnerability arises when attacker-controlled input is stored by the backend and later rendered in the WebUI without proper output encoding. This flaw allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially leading to session token theft or unauthorized actions. The vulnerability can be exploited by injecting malicious scripts into the 'comment' field during rule creation, which are then executed when the rule is viewed or approved.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 35.8.335.8.3pip install --upgrade "rucio-webui==35.8.3" -
>= 36.0.0rc1, < 38.5.438.5.4pip install --upgrade "rucio-webui==38.5.4" -
>= 39.0.0rc1, < 39.3.139.3.1pip install --upgrade "rucio-webui==39.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the Custom Rules function until the package is updated. Additionally, implement proper HTML escaping for any user-controlled data before rendering it in the WebUI.
Conclusion
The Rucio WebUI has a critical stored XSS vulnerability that can be exploited through the Custom Rules function. It is essential to update to the patched versions to safeguard against potential attacks. Users should also consider implementing additional security measures to protect their applications.
See every vulnerability recorded for rucio-webui →
FAQ
The CVSS score of this vulnerability is 7.3, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability allows attackers to execute arbitrary JavaScript in the WebUI, which can lead to session token theft, unauthorized actions, and potentially compromise user accounts.
If an immediate update is not possible, refrain from using the affected features and ensure proper HTML escaping for any user-controlled data.
Implementing a strict Content Security Policy (CSP) and setting the HttpOnly flag on session cookies can help mitigate the risk while using a vulnerable version.
Related vulnerabilities
Recent vulnerabilities recorded for rucio-webui.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
