CVE-2026-88743 in Bacularis
Summary
by MITRE • 09/15/2026
Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within Bacularis versions ranging from 4.7.0 through 6.5.0 represents a critical security flaw classified as stored cross-site scripting, commonly referred to as persistent XSS. This specific weakness is located within the handling of director tags, which are fundamental components used for organizing and managing backup jobs and client configurations within the Bacularis web interface. Unlike reflected XSS attacks that require an attacker to trick a user into clicking a malicious link, this vulnerability allows an adversary to inject malicious script payloads directly into data fields that are subsequently stored on the server-side database or configuration files. When other authorized users access these affected director tags through their browser sessions, the injected scripts execute automatically within the context of the victim's active session, bypassing standard client-side security controls such as same-origin policies.
From a technical perspective, this flaw stems from insufficient input validation and inadequate output encoding mechanisms in the application code responsible for rendering director tag information. When user-supplied data is accepted without rigorous sanitization checks against special characters or script delimiters, it allows arbitrary JavaScript to be embedded into the HTML structure of the page. The persistence of this payload means that the malicious code remains active on the server until the underlying record is manually deleted by an administrator. This creates a long-term attack surface where any user with access privileges can inadvertently trigger the execution of attacker-controlled commands simply by viewing or editing specific configuration elements, thereby turning routine administrative tasks into vectors for compromise.
The operational impact of this vulnerability is severe due to its potential for session hijacking and privilege escalation within the backup management infrastructure. An exploited instance allows an attacker to steal sensitive authentication tokens, cookies, or session identifiers associated with other users who view the compromised director tags. This can lead to unauthorized access to critical backup configurations, potentially resulting in data exfiltration, modification of retention policies, or disruption of disaster recovery capabilities by altering job schedules and client associations. Furthermore, because Bacularis often manages sensitive enterprise data backups, compromising user sessions could provide a foothold for lateral movement within the network if those accounts possess broader administrative rights beyond just the web interface.
This vulnerability aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as Cross-site Scripting (XSS), specifically under the subcategory of stored or persistent variants where data is saved before being rendered to users. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution via web browsers, and falls under the initial access tactic if used for phishing-like scenarios within internal networks or the persistence tactic due to its stored nature. Mitigation strategies should prioritize immediate patching to version 6.5.1 or later where this issue has been addressed through enhanced input sanitization routines. In environments where upgrading is not immediately feasible, administrators can implement web application firewall rules that detect and block common script injection patterns in tag fields, although such controls are less reliable than code-level fixes. Regular auditing of user inputs and enforcing strict content security policies to restrict inline script execution also serve as effective defensive layers against this class of vulnerability.