CVE-2026-88743: Bacularis Stored XSS Vulnerability

CVE-2026-88743 Overview

CVE-2026-88743 is a stored cross-site scripting (XSS) vulnerability affecting Bacularis versions 4.7.0 through 6.5.0. The flaw resides in the director tags feature, where user-supplied input is stored and later rendered without proper output encoding. An authenticated attacker can inject persistent JavaScript payloads that execute in the browser context of other users viewing the affected page.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions against the Bacularis backup management interface. The vulnerability is classified under [CWE-79].

Affected Products

Bacularis 4.7.0 through 6.5.0
Bacularis director tags component
Web-based backup management interface

Discovery Timeline

2026-09-15 - CVE-2026-88743 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-88743

Vulnerability Analysis

Bacularis is a web-based management interface for the Bacula backup solution. The affected versions fail to properly sanitize or encode user-controlled input submitted through director tags. When another user views the page containing the malicious tag, the browser interprets the injected content as executable script rather than plain text.

Because the payload is stored server-side, any user with access to the affected view triggers execution without additional interaction beyond visiting the page. The scope change indicated by the CVSS vector reflects that injected script executes in the security context of the Bacularis application, crossing trust boundaries.

Root Cause

The root cause is missing or insufficient output encoding when rendering director tag values in the web interface. Input persists in application storage in its raw form, and the rendering layer emits it directly into HTML without contextual escaping. This pattern maps to [CWE-79], Improper Neutralization of Input During Web Page Generation.

Attack Vector

An authenticated attacker with permission to create or modify director tags submits a payload containing HTML or JavaScript. The payload is stored in the Bacularis backend. When a privileged operator subsequently loads the tag view, the script executes with the operator's session privileges, potentially allowing account takeover, backup job manipulation, or lateral pivoting into backup infrastructure.

For payload construction and reproduction steps, see the Hekk One research on CVE-2026-88743 and the GitHub CVE repository.

Detection Methods for CVE-2026-88743

Indicators of Compromise

Director tag values containing HTML tags such as <script>, <img>, <svg>, or on* event handler attributes
Unexpected outbound HTTP requests from Bacularis operator browsers to attacker-controlled domains
Anomalous session activity or configuration changes performed shortly after viewing tag-related pages

Detection Strategies

Inspect Bacularis database records for tag fields containing angle brackets, JavaScript URI schemes, or encoded script fragments
Review web server access logs for POST requests to tag creation and modification endpoints with suspicious payload lengths or characters
Deploy Content Security Policy (CSP) reporting to identify blocked inline script execution attempts on Bacularis pages

Monitoring Recommendations

Enable audit logging for all create, update, and delete operations on director tags
Monitor administrator and operator session cookies for reuse from unexpected IP addresses
Alert on browser-originated requests to Bacularis administrative endpoints outside expected user workflows

How to Mitigate CVE-2026-88743

Immediate Actions Required

Upgrade Bacularis to a version above 6.5.0 once a fixed release is published by the vendor
Restrict tag creation and modification privileges to trusted administrators only
Audit existing director tag entries and remove any containing HTML or scripting content
Rotate session credentials for any account that may have viewed attacker-controlled tag data

Patch Information

No vendor advisory URL is currently listed in the CVE record. Consult the GitHub CVE repository and monitor the Bacularis project release notes for a fixed version. Apply the patched release across all Bacularis instances as soon as it becomes available.

Workarounds

Place Bacularis behind a web application firewall (WAF) with rules blocking HTML and script metacharacters in tag input fields
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Limit access to the Bacularis interface via network segmentation, VPN, or IP allowlisting until a patch is applied

bash

# Example nginx CSP header to reduce stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;