# CVE-2026-25734: PYSEC-2026-3057 - Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Source: https://junglewise.ai/threats/cve-2026-25734-rucio-webui-has-stored-cross-site-scripting-xss-in-rse-metadata  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-25734 · Severity: low · CVSS 3.1 · Published 2026-07-13

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Technologies: [rucio-webui (PyPI)](https://junglewise.ai/threats/technologies/rucio-webui). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-25734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25734 being exploited in the wild.

**How severe is CVE-2026-25734?** Low severity, with a CVSS score of 3.1, published 13 July 2026.

**Which products and versions are affected?** rucio-webui (PyPI) ECOSYSTEM:introduced=0,fixed=35.8.3, ECOSYSTEM:introduced=0,fixed=35.8.3,introduced=36.0.0rc1,fixed=38.5.4,introduced=39.0.0rc1,fixed=39.3.1.

**Is there a fix for CVE-2026-25734?** Yes. rucio-webui (PyPI): upgrade to 35.8.3, 39.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-25734?** Check whether you run rucio-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rucio-webui (PyPI): upgrade to 35.8.3, 39.3.1 or later

  ```sh
  pip install "rucio-webui>=39.3.1"
  ```


## Affected products

- rucio-webui (PyPI) ECOSYSTEM:introduced=0,fixed=35.8.3, ECOSYSTEM:introduced=0,fixed=35.8.3,introduced=36.0.0rc1,fixed=38.5.4,introduced=39.0.0rc1,fixed=39.3.1

## Identifiers

- CVE-2026-25734
- GHSA-h9fp-p2p9-873q
- PYSEC-2026-3057

## Related threats

- [PYSEC-2026-3055 - Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute](https://junglewise.ai/threats/cve-2026-25736-rucio-webui-has-a-stored-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-3054 - Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name](https://junglewise.ai/threats/cve-2026-25735-rucio-webui-has-a-stored-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-3058 - Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function](https://junglewise.ai/threats/cve-2026-25733-rucio-webui-vulnerable-to-stored-cross-site-scripting-xss-through)
- [PYSEC-2026-3053 - Rucio WebUI has Username Enumeration via Login Error Message](https://junglewise.ai/threats/cve-2026-25138-rucio-webui-username-enumeration-via-login-error-message)
- [PYSEC-2026-3056 - Rucio WebUI has a Reflected Cross-site Scripting Vulnerability](https://junglewise.ai/threats/cve-2026-25136-rucio-webui-has-a-reflected-cross-site-scripting-vulnerability)