CVE-2026-95166: Bacularis XSS Vulnerability

CVE-2026-95166 Overview

CVE-2026-95166 is a stored Cross-Site Scripting (XSS) vulnerability in Bacularis versions 1.0.0 through 6.5.1. The flaw resides in the LabelFormat field exposed when administrators create a new pool. Bacularis fails to sanitize input submitted through this field, allowing an authenticated attacker to inject arbitrary JavaScript that executes in the browsers of other users viewing the pool configuration. The weakness is tracked as [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated low-privilege user can inject JavaScript that runs in an administrator's browser session, enabling session theft, unauthorized backup operations, or lateral movement within the Bacularis management interface.

Affected Products

Bacularis 1.0.0 through 6.5.1

Discovery Timeline

2026-10-05 - CVE-2026-95166 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-95166

Vulnerability Analysis

Bacularis is a web-based management interface for the Bacula backup system. The pool configuration workflow exposes a LabelFormat field used to define the naming convention for backup volumes. The application accepts user-supplied content in this field and renders it back into subsequent web pages without proper output encoding.

An attacker with permission to create or edit a pool can supply a payload containing HTML and JavaScript. When another user, typically an administrator, loads a page that renders the pool's LabelFormat value, the browser executes the injected script in the context of the Bacularis origin.

The scope change reflected in the CVSS vector indicates the payload can act outside the immediate component boundary. Confidentiality and integrity impact are limited to data accessible through the victim's session, which in a backup management console includes credentials, job definitions, and storage targets.

Root Cause

The root cause is missing output encoding on the LabelFormat parameter. Bacularis treats pool metadata as trusted and returns it to the DOM without HTML entity escaping or a strict Content Security Policy to constrain inline script execution.

Attack Vector

Exploitation requires an authenticated session with privileges to add or modify a pool and relies on another user subsequently viewing the affected pool. The attacker submits a crafted LabelFormat value through the pool creation form. The stored payload fires whenever an operator opens the pool details view, giving the attacker JavaScript execution under the victim's identity.

Technical details are published in the researcher's writeup. See the Hekk Research on CVE-2026-95166 and the GitHub CVE Repository for proof-of-concept information.

Detection Methods for CVE-2026-95166

Indicators of Compromise

Pool records whose LabelFormat field contains HTML tags, <script> elements, javascript: URIs, or event handler attributes such as onerror= and onload=.
Bacularis web server access logs showing POST requests to pool creation or edit endpoints with payload bodies containing encoded script fragments.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts shortly after loading a pool page.

Detection Strategies

Query the Bacularis configuration store for pool entries where LabelFormat deviates from the expected Bacula label syntax (alphanumeric characters, $, -, and _).
Deploy web application firewall rules that inspect pool form submissions for XSS signatures prior to reaching the Bacularis backend.
Correlate audit log entries for pool creation events against the identity of low-privilege accounts that should not perform administrative changes.

Monitoring Recommendations

Enable verbose audit logging on the Bacularis API and ship logs to a centralized SIEM for retention and search.
Alert on administrator session tokens used from new IP addresses within minutes of a pool configuration change.
Monitor browser Content Security Policy violation reports if CSP is enforced on the Bacularis interface.

How to Mitigate CVE-2026-95166

Immediate Actions Required

Restrict pool creation and modification privileges to a small set of trusted administrators until a patched release is deployed.
Audit all existing pool LabelFormat values and remove entries containing HTML or script content.
Rotate Bacularis user credentials and invalidate active administrator sessions if suspicious pool entries are found.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the Bacularis project for a release beyond 6.5.1 that addresses output encoding on pool fields. Consult the GitHub CVE Repository and Hekk Research on CVE-2026-95166 for upstream fix status.

Workarounds

Place the Bacularis interface behind a reverse proxy that enforces a strict Content Security Policy prohibiting inline scripts.
Apply WAF rules that reject pool form submissions containing <, >, or javascript: sequences in the LabelFormat parameter.
Limit network access to the Bacularis web interface to administrative workstations through firewall or VPN controls.

bash

# Example nginx reverse-proxy header enforcing a restrictive CSP for Bacularis
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;