CVE-2026-95165: Bacularis XSS Vulnerability

CVE-2026-95165 Overview

CVE-2026-95165 is a Cross-Site Scripting (XSS) vulnerability in Bacularis, a web-based management interface for the Bacula backup software. The flaw resides in the Organization name field, where user-supplied input is rendered without proper sanitization. An attacker who injects crafted script content into this field can execute arbitrary JavaScript in the browser of any user who subsequently views the affected page. The issue affects Bacularis versions 5.4.0 through 6.5.1 and is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed in the context of an authenticated Bacularis user.

Affected Products

Bacularis 5.4.0
Bacularis versions 5.4.1 through 6.5.0
Bacularis 6.5.1

Discovery Timeline

2026-10-05 - CVE-2026-95165 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-95165

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) flaw affecting the Organization name field in Bacularis. The application accepts input into this field and later renders it in the web interface without sufficient output encoding. When an authenticated user views a page containing the malicious organization name, the browser interprets the injected payload as executable script.

Because the attack requires user interaction and the scope changes between the vulnerable component and the impacted browser, the issue carries confidentiality and integrity consequences but does not affect availability. The EPSS data indicates a low near-term exploitation probability, but stored XSS flaws in administrative interfaces remain attractive to attackers seeking privilege escalation inside backup infrastructure.

Root Cause

The root cause is improper neutralization of HTML and JavaScript metacharacters in the Organization name input. Bacularis does not apply contextual output encoding when echoing the value back into HTML pages. Any character sequence resembling script tags or event handlers is rendered as live markup rather than inert text.

Attack Vector

An attacker with permission to create or edit an organization record submits a payload containing JavaScript into the Organization name field. The payload persists in the Bacularis data store. When another user, such as an administrator, loads a view that displays the organization name, the script executes under the victim's session. The attacker can then exfiltrate session cookies, modify backup job configurations, or trigger administrative actions via the Bacularis API.

No verified proof-of-concept code is published. Refer to the Hekk Research CVE Analysis for additional technical context.

Detection Methods for CVE-2026-95165

Indicators of Compromise

Organization name fields in Bacularis containing HTML tags, <script> elements, or JavaScript event handlers such as onerror= or onload=.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains after loading Bacularis pages.
Unauthorized configuration changes, new user accounts, or modified backup jobs appearing shortly after an administrator session.

Detection Strategies

Audit the Bacularis database for organization records whose names contain angle brackets, quotes, or encoded script fragments.
Review web server access logs for POST requests to organization creation and edit endpoints with payloads matching XSS signatures.
Enable Content Security Policy (CSP) violation reporting to surface attempted inline script execution in the Bacularis UI.

Monitoring Recommendations

Monitor administrative session activity for anomalous API calls occurring immediately after viewing organization-related pages.
Alert on changes to Bacularis user roles, backup targets, or credential stores performed outside normal change windows.
Track browser console errors and CSP reports originating from Bacularis endpoints to identify active exploitation attempts.

How to Mitigate CVE-2026-95165

Immediate Actions Required

Upgrade Bacularis to a release later than 6.5.1 once the vendor publishes a fixed version.
Audit existing organization records and remove any entries containing HTML or script content.
Restrict permissions for creating and editing organization records to trusted administrators only.
Force a password reset and session invalidation for users who may have viewed malicious organization names.

Patch Information

At the time of publication, no specific patched version is listed in the NVD entry for CVE-2026-95165. Monitor the Bacularis project and the referenced GitHub CVE Repository for updates. Apply the fixed release as soon as it becomes available for the affected 5.4.0 through 6.5.1 range.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place Bacularis behind a web application firewall configured to block XSS payloads in form submissions.
Limit network access to the Bacularis management interface to administrative subnets and VPN users.

bash

# Example nginx CSP header to reduce stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;