Executive brief
Bacularis is a backup and recovery management interface used by system administrators to manage backup jobs and policies. A stored cross-site scripting vulnerability in the director tags feature allows attackers to inject malicious JavaScript that executes for all users when they view tagged jobs, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of administrators.
Technical details
Bacularis versions 4.7.0 through 6.5.0 are vulnerable to stored XSS via the tag name field in Director / Configure director / JobDefs. An attacker can inject a JavaScript payload (e.g., <script>prompt()</script>) into the tag name parameter by intercepting the tag creation request and modifying the JSON payload in the msg_envelope_search parameter. The payload is stored server-side and executed in the browser context of any user who views jobs or navigates the application interface. Attack requires authenticated access to the application but affects any user with job visibility permissions, including normal (non-admin) users. The vulnerability is fixed in version 6.5.1.
Affected products
- Bacularis Bacularis 4.7.0 through 6.5.0
Timeline
- 2026-09-11: disclosed
- 2026: patched: Fixed in version 6.5.1