Bacularis CVE-2026-95166

Requires an authenticated Bacularis account with privilege to add a new backup pool (PR:L), running an affected version (v1.0.0-6.5.1). The attacker injects script into the LabelFormat field during pool creation; the stored payload only executes when another authenticated user (e.g., an administrator) subsequently views the pool configuration page, so victim user interaction (UI:R) is required. Limiting factors: no unauthenticated path, the attacker needs valid low-privilege credentials, and successful impact depends on a higher-privileged victim actually opening the affected view - reducing realistic blast radius despite the network attack vector.

This is a moderate-severity stored Cross-Site Scripting flaw (CVSS 5.4) whose real-world priority is modest. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows exploitation is network-reachable and low-complexity but requires an authenticated low-privilege account (PR:L) AND victim user interaction (UI:R), which materially constrains exploitability - this is not a drive-by, unauthenticated RCE. The scope change (S:C) and C:L/I:L reflect that injected script runs in the victim's browser context rather than compromising the server directly. EPSS is very low at 0.14% (3rd percentile), consistent with a self-service XSS requiring authentication and interaction rather than a mass-exploited issue. This CVE is NOT in CISA KEV (no confirmed active exploitation), and no public exploit is confirmed - one reference is a 'to_be_released' GitHub path and the other a researcher blog, implying a POC may be forthcoming but is not yet published. All signals align: real but low-urgency. No conflicts between CVSS, EPSS, and exploitation status were observed. The chief gap is product/vendor metadata: CPE and EUVD affected-version fields are literally 'n/a', so the authoritative affected-version range comes only from the CVE description (Bacularis v1.0.0 through 6.5.1).

An authenticated low-privilege Bacularis user creates a new backup pool and enters a crafted XSS payload into the LabelFormat field, which is stored and later rendered without sanitization. When an administrator or another operator views that pool's configuration in the web console, the script executes in their browser session, potentially stealing session tokens or performing actions as the victim. No public exploit is confirmed at time of analysis, though a researcher advisory and a reserved ('to_be_released') POC reference exist.