# CVE-2026-88743: Bacularis stored XSS in director tags

Source: https://junglewise.ai/threats/cve-2026-88743-bacularis-stored-xss-in-director-tags  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88743 · Severity: medium · CVSS 6.1 · Published 2026-09-15

Bacularis is a backup and recovery management interface used by system administrators to manage backup jobs and policies. A stored cross-site scripting vulnerability in the director tags feature allows attackers to inject malicious JavaScript that executes for all users when they view tagged jobs, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of administrators.

Technologies: [Bacularis](https://junglewise.ai/threats/technologies/bacularis). Vendors: [Bacularis](https://junglewise.ai/threats/vendors/bacularis).

## Quick answers

**Is CVE-2026-88743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88743 being exploited in the wild.

**How severe is CVE-2026-88743?** Medium severity, with a CVSS score of 6.1, published 15 September 2026.

**Which products and versions are affected?** Bacularis 4.7.0 through 6.5.0.

**Is there a fix for CVE-2026-88743?** A patch was published on 2026: Fixed in version 6.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88743 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88743?** Check whether you run Bacularis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Bacularis versions 4.7.0 through 6.5.0 are vulnerable to stored XSS via the tag name field in Director / Configure director / JobDefs. An attacker can inject a JavaScript payload (e.g., <script>prompt()</script>) into the tag name parameter by intercepting the tag creation request and modifying the JSON payload in the msg_envelope_search parameter. The payload is stored server-side and executed in the browser context of any user who views jobs or navigates the application interface. Attack requires authenticated access to the application but affects any user with job visibility permissions, including normal (non-admin) users. The vulnerability is fixed in version 6.5.1.

## Affected products

- Bacularis Bacularis 4.7.0 through 6.5.0

## Timeline

- 2026-09-11: disclosed
- 2026: patched: Fixed in version 6.5.1

## References

- [https://github.com/hekk-one/CVE](https://github.com/hekk-one/CVE)
- [https://hekk.one/posts/research/cve-2026-88743/](https://hekk.one/posts/research/cve-2026-88743/)

## Related threats

- [Bacularis stored cross-site scripting in Organization name](https://junglewise.ai/threats/cve-2026-95165-bacularis-5-4-0-6-5-1-is-vulnerable-to-cross-site-scripting-xss)
- [Bacularis stored XSS in client address field](https://junglewise.ai/threats/cve-2026-88742-bacularis-stored-xss-in-client-address-field)