CVE-2026-95165 in Bacularis
Summary
by MITRE • 10/05/2026
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Bacularis versions ranging from 5.4.0 through 6.5.1 represents a classic Stored Cross-Site Scripting flaw located within the organization name input field of the web-based management interface. This type of vulnerability arises when an application accepts user-supplied data, such as the name of an organization or entity being configured in the system, and subsequently includes that data in HTTP responses without performing adequate validation or encoding. In this specific instance, the backend processing logic fails to sanitize special characters like angle brackets, ampersands, quotes, and other HTML metacharacters before storing them in the database or rendering them back into the user interface. Consequently, when an administrator or authorized user with sufficient privileges inputs a malicious script payload disguised as part of the organization name, that code is persisted on the server side rather than being executed immediately during input entry.
The operational impact of this vulnerability is significant because it allows for persistent attacks against any user who accesses the affected page where the organization details are displayed. Unlike reflected XSS which requires tricking a victim into clicking a malicious link, stored XSS ensures that every time an authorized user views the configuration or dashboard containing the tainted data, their browser executes the injected JavaScript code in the context of the application's domain. This effectively bypasses same-origin policy restrictions and grants the attacker the ability to perform actions on behalf of the victim, steal session cookies or authentication tokens, capture keystrokes entered into other fields within the interface, or even redirect users to phishing sites designed to harvest credentials. Since Bacularis is a backup management solution often handling sensitive data integrity configurations, compromising an administrator account could lead to broader system compromise including manipulation of backup schedules, deletion of critical backups, or exfiltration of backed-up data depending on the permissions associated with that session.
From a technical classification perspective, this flaw aligns directly with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the subcategory of Stored XSS where malicious scripts are permanently stored within target databases or content management systems. In terms of adversary behavior mapping to MITRE ATT&CK frameworks, this vulnerability facilitates techniques related to Collection via Browser Capture such as Screen Capture or Keylogging through injected JavaScript hooks, as well as Credential Access by stealing session cookies that maintain administrative access without requiring password re-entry. The persistence mechanism inherent in stored XSS makes it particularly dangerous for long-term unauthorized access and lateral movement within an organization's IT infrastructure if the backup management system is integrated with other critical systems via API or shared credentials.
Mitigation strategies must address both immediate remediation and long-term secure coding practices. The primary technical fix involves implementing strict output encoding on all dynamic content rendered in HTML contexts, ensuring that special characters are converted to their corresponding HTML entities before being sent to the browser. Additionally input validation should be enforced using a whitelist approach where only expected alphanumeric characters for organization names are permitted, rejecting any input containing script tags or event handlers. Upgrading Bacularis to a version beyond 6.5.1 is essential as these newer releases likely contain patches that implement proper sanitization libraries and framework-level protections against XSS attacks. Security administrators should also enforce Content Security Policy headers within the web server configuration to restrict inline script execution, providing an additional layer of defense even if input validation fails. Regular security audits and penetration testing focused on injection flaws are recommended to identify similar vulnerabilities in other fields across the application interface before they can be exploited by malicious actors targeting backup infrastructure management tools.