Security readout for executives and security teams
Plain-English summary
Rucio WebUI can store unsafe input in a custom RSE attribute and later show it to other users. If a privileged attacker can set that value, JavaScript may run in a victim’s browser when they view the affected page. This can risk session theft or actions performed as that user.
Executive priority
Prioritize remediation in the next normal security update cycle, sooner for shared or multi-tenant Rucio environments. The issue is not described as actively exploited, but successful abuse could compromise user sessions and data-management actions in the WebUI.
Technical view
CVE-2026-25736 is a stored XSS in Rucio WebUI Custom RSE Attribute handling. Affected versions persist attacker-controlled input server-side and render it without proper output encoding. The CVSS 3.1 score is 6.1 with network access, low complexity, high privileges required, and user interaction required. Fixed versions are 35.8.3, 38.5.4, and 39.3.1.
Likely exposure
Exposure is limited to organizations running Rucio WebUI on affected version ranges: before 35.8.3, 36.0.0rc1 through before 38.5.4, or 39.0.0rc1 through before 39.3.1. Risk is higher where users with rights to modify Custom RSE Attributes are numerous or less trusted.
Exploitation context
The vulnerability requires an attacker with high privileges to save malicious content and a separate user to view the affected WebUI page. The provided sources do not report active exploitation, and the CVE is not listed as KEV in the supplied data.
Researcher notes
Focus validation on version identification, WebUI exposure, and authorization around Custom RSE Attribute changes. Avoid assuming broader Rucio components are affected; the source specifically names the WebUI Custom RSE Attribute. The advisory attributes impact to improper output encoding of persisted backend data.
Mitigation direction
- Upgrade Rucio to 35.8.3, 38.5.4, or 39.3.1 as applicable.
- Review vendor advisory GHSA-fq4f-4738-rqxm for environment-specific guidance.
- Restrict who can modify Custom RSE Attributes until patched.
- Follow OWASP output-encoding guidance for any local WebUI customizations.
Validation and detection
- Inventory Rucio WebUI deployments and record exact versions.
- Compare deployed versions against the affected ranges in the advisory.
- Confirm patched releases are installed after remediation.
- Review Custom RSE Attribute change permissions and recent modifications.
- Check WebUI rendering paths for proper output encoding in custom changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1004: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-25736 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N0.95.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/rucio/rucio/security/advisories/GHSA-fq4f-4738-rqxmCVE reference · x_refsource_CONFIRM
- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.htmlCVE reference · x_refsource_MISC
- https://github.com/rucio/rucio/releases/tag/35.8.3CVE reference · x_refsource_MISC
- https://github.com/rucio/rucio/releases/tag/38.5.4CVE reference · x_refsource_MISC
- https://github.com/rucio/rucio/releases/tag/39.3.1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Sensitive Cookie Without 'HttpOnly' Flag
Sensitive Cookie Without 'HttpOnly' Flag represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.