CVE-2026-88742: Bacularis Stored XSS Vulnerability

CVE-2026-88742 Overview

CVE-2026-88742 is a stored cross-site scripting (XSS) vulnerability affecting Bacularis versions 1.0.0 through 6.5.0. The flaw resides in the client address field, where user-supplied input is stored without adequate output encoding or sanitization. An attacker with the ability to create or modify a Bacularis client entry can inject JavaScript payloads that execute in the browser of any user who subsequently views the affected page. Bacularis is a web-based management interface for the Bacula backup software, so successful exploitation places administrator sessions and backup infrastructure metadata at risk.

Critical Impact
Stored JavaScript executes in administrator browsers, enabling session theft, unauthorized backup configuration changes, and pivoting into backup infrastructure.

Affected Products

Bacularis 1.0.0 through 6.5.0
Bacularis web management interface (client address field)
Deployments exposing the Bacularis UI to multiple users or tenants

Discovery Timeline

2026-09-15 - CVE-2026-88742 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-88742

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in the Bacularis web UI. Bacularis accepts arbitrary string input in the client address field when defining or editing a backup client. The application persists this input in the backend database. When another user loads a page that renders that client record, the browser interprets the stored value as HTML and JavaScript rather than as literal text.

Stored XSS in an administrative backup console is particularly consequential. Bacularis operators typically hold privileges to schedule jobs, define storage destinations, and initiate restores. An injected payload running in an administrator session can therefore reach backup catalogs, credentials passed to Bacula daemons, and restore targets.

Root Cause

The root cause is missing output encoding on the client address field. The application does not apply context-appropriate HTML entity encoding when rendering the stored value back into the DOM. Input validation on the field is also insufficient to reject markup characters. See the Hekk One CVE Research Post for the reproduction details.

Attack Vector

An attacker who can authenticate to the Bacularis UI, or who can influence the client address value through any upstream provisioning workflow, submits a payload containing HTML script content in place of a hostname or IP address. The payload is stored and executes when an operator opens the client list or the affected client detail view. The attack requires a victim to load the affected page, so exploitation depends on user interaction.

No verified proof-of-concept code is published beyond the referenced research. Consult the GitHub CVE Repository for further technical detail.

Detection Methods for CVE-2026-88742

Indicators of Compromise

Client address field values containing <script>, onerror=, onload=, javascript:, or encoded HTML entities in place of a hostname or IP address.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after loading Bacularis client pages.
New or modified Bacularis client entries created by low-privilege accounts.

Detection Strategies

Query the Bacularis database and audit client address values against a strict hostname or IP regular expression. Flag any entries containing angle brackets, quotes, or protocol handlers.
Review web server access logs for POST requests to client creation and edit endpoints that carry markup characters in form parameters.
Correlate Bacularis administrative session activity with browser-originated requests to unfamiliar external hosts.

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting on the Bacularis origin to surface inline script execution attempts.
Log and alert on all writes to the Bacularis client configuration table, including the identity of the acting user.
Monitor administrator workstations for anomalous outbound connections initiated during Bacularis sessions.

How to Mitigate CVE-2026-88742

Immediate Actions Required

Upgrade Bacularis to a version later than 6.5.0 once the vendor publishes a patched release.
Audit all existing client records for stored payloads and sanitize any entries containing HTML or JavaScript syntax.
Restrict Bacularis UI access to trusted administrators and place the console behind a VPN or reverse proxy that enforces authentication.

Patch Information

No vendor advisory URL is available in the enriched CVE data at the time of writing. Track the Hekk One CVE Research Post and the Bacularis project release notes for a fixed version. Apply the update across all Bacularis instances in the environment once available.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to the Bacularis origin.
Add a web application firewall rule that rejects requests to the client configuration endpoints when the address parameter contains <, >, or javascript: substrings.
Limit client creation and modification privileges to a small group of trusted operators until a patched release is deployed.

bash

# Example WAF rule pattern (ModSecurity-style) to block markup in the client address field
SecRule ARGS:address "@rx (?i)(<script|onerror=|onload=|javascript:)" \
    "id:1026887420,phase:2,deny,status:400,log,msg:'Bacularis CVE-2026-88742 XSS attempt'"