Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Identity Name of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-25 | 1 | Disclosure1 |
| 2026-02-26 | 1 | General1 |
CVE-2026-25735 Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior… https://www.cve.org/CVERecord?id=CVE-2026-25735
Post summary
The text briefly references CVE-2026-25735 for Rucio but provides no further details.
CVE-2026-25735: Rucio WebUI: When Scientific Data Management Meets Unsanitized jQuery A critical Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Rucio WebUI, the interface for the open-source scientific data management framework ... https://cvereports.com/reports/CVE-2026-25735
Post summary
A new critical stored XSS vulnerability in Rucio WebUI (CVE-2026-25735) has been disclosed, but no exploitation or mitigation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | cern | rucio | - | - | - |