CVE-2026-95166 in Bacularis
Summary
by MITRE • 10/05/2026
In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Bacularis versions ranging from 1.0.0 to 6.5.1 represents a significant security flaw within the backup management interface, specifically targeting the pool configuration functionality. When an administrator or authorized user attempts to create a new storage pool, the system presents a field labeled LabelFormat for defining how volume labels are generated. This input vector is susceptible to Cross-Site Scripting due to insufficient sanitization and validation of user-supplied data before it is processed by the backend application logic. The flaw allows an attacker who possesses valid credentials or can manipulate session tokens to inject malicious client-side scripts into the LabelFormat field, which are then stored within the system's configuration database without proper encoding or escaping mechanisms in place.
From a technical perspective, this vulnerability falls under the category of Stored Cross-Site Scripting, also known as Persistent XSS. Unlike reflected XSS where the payload is executed immediately during a request, stored XSS involves the malicious script being saved on the target server and subsequently served to other users when they access the affected page. In the context of Bacularis, this means that whenever an administrator views or edits pool configurations in the web interface, the injected JavaScript code executes within their browser session under the trust context of the application. This execution environment grants the script full access to cookies, local storage, and session tokens associated with the authenticated user's account, effectively bypassing same-origin policy protections intended to isolate different websites from each other.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and data exfiltration. An attacker can leverage the executed scripts to perform actions on behalf of the victim administrator, such as modifying backup schedules, altering retention policies, or accessing sensitive configuration files stored within the Bacularis environment. Furthermore, by stealing session cookies, an attacker could hijack active administrative sessions, gaining persistent access to the backup infrastructure without needing valid credentials again. This compromises not only the confidentiality and integrity of the management interface but also potentially exposes the underlying data protected by the backup system if the application logic allows script-driven interactions with sensitive endpoints or APIs exposed by the Bacularis server.
This vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The root cause lies in the failure to implement robust input validation and output encoding strategies for dynamic content generation within the web application framework used by Bacularis. Additionally, from a tactical perspective related to cyber kill chains, this flaw facilitates initial access and credential harvesting phases described in MITRE ATT&CK techniques such as T1078 Valid Accounts and potentially T1539 Steal Web Session Cookie if session tokens are successfully exfiltrated through the injected script payload.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade Bacularis to a version newer than 6.5.1 where this specific input validation flaw has been patched by the developers. For environments unable to update immediately, implementing a Web Application Firewall can provide an additional layer of defense by filtering out requests containing known XSS patterns in the LabelFormat parameter before they reach the application server. Administrators should also enforce strict Content Security Policy headers that restrict script execution sources and disable inline scripts where possible, although this may require careful tuning to avoid breaking legitimate functionality. Regular security audits focusing on input validation across all user-facing forms are essential to prevent similar vulnerabilities from being introduced in future updates or custom configurations.