PT-2026-27182 · Unknown · Mantis Bug Tracker

Shukla304 · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33517

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker versions prior to 2.28.1

Description Mantis Bug Tracker is an open source issue tracker. A flaw exists in version 2.28.0 where improper escaping of a tag name during the display of a confirmation message when deleting a tag (via the tag delete.php script) allows an attacker to inject HTML. If Content Security Policy (CSP) settings permit, this can lead to the execution of arbitrary JavaScript. The vulnerable parameter is the tag name displayed in the confirmation message.

Recommendations Upgrade to Mantis Bug Tracker version 2.28.1 or later. As a temporary workaround, revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9. As a temporary workaround, manually edit language files to remove the sprintf placeholder %1$s from the $s tag delete message string.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-33517

GHSA-FH48-F69W-7VMP

Produtos afetados

Mantis Bug Tracker

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33517.json · Exploit
• https://github.com/mantisbt/mantisbt · Nota
• https://github.com/mantisbt/mantisbt/commit/d6890320752ecf37bd74d11fe14fe7dc12335be9 · Correção
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fh48-f69w-7vmp · Aviso do Fabricante
• https://github.com/mantisbt/mantisbt/commit/80990f43153167c73f11eb4b2bc7108d0c3d6b46 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-33517 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33517 · Aviso do Fabricante
• https://mantisbt.org/bugs/view.php?id=36971 · Nota
• https://osv.dev/vulnerability/GHSA-fh48-f69w-7vmp · Aviso do Fabricante