CVE-2026-25136 - Vulnerability Analysis
HighCVSS: 8.1Last Updated: February 25, 2026
Rucio - Reflected XSS
Published: February 25, 2026Updated: February 25, 2026Remote Exploitable
Overview
Rucio < 35.8.3, < 38.5.4, and < 39.3.1 contain a reflected XSS caused by improper rendering of ExceptionMessage in WebUI 500 error, letting attackers steal login session tokens via crafted URLs, exploit requires user interaction.
Severity & Score
Severity: High
CVSS Score: 8.1
Impact
Attackers can steal login session tokens, leading to account compromise and unauthorized access.
Mitigation
Update to versions 35.8.3, 38.5.4, or 39.3.1 or later.
References
- https://github.com/rucio/rucio/releases/tag/38.5.4
- https://github.com/rucio/rucio/releases/tag/39.3.1
- https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
- https://github.com/rucio/rucio/releases/tag/35.8.3
Related Resources
Details
- CVE ID
- CVE-2026-25136
- Severity
- High
- CVSS Score
- 8.1
- Type
- reflected_xss
- Status
- new
CWE
- CWE-79
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N