PT-2026-27182 · Unknown · Mantis Bug Tracker

Shukla304 · Published 2026-03-23 · Updated 2026-03-25 · CVE-2026-33517

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker versions prior to 2.28.1

Description Mantis Bug Tracker is an open source issue tracker. A flaw exists in version 2.28.0 where improper escaping of a tag name during the display of a confirmation message when deleting a tag (via the tag delete.php script) allows an attacker to inject HTML. If Content Security Policy (CSP) settings permit, this can lead to the execution of arbitrary JavaScript. The vulnerable parameter is the tag name displayed in the confirmation message.

Recommendations Upgrade to Mantis Bug Tracker version 2.28.1 or later. As a temporary workaround, revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9. As a temporary workaround, manually edit language files to remove the sprintf placeholder %1$s from the $s tag delete message string.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33517

GHSA-FH48-F69W-7VMP

Affected Products

Mantis Bug Tracker

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33517.json · Exploit
• https://github.com/mantisbt/mantisbt/commit/d6890320752ecf37bd74d11fe14fe7dc12335be9 · Patch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fh48-f69w-7vmp · Vendor Advisory
• https://github.com/mantisbt/mantisbt/commit/80990f43153167c73f11eb4b2bc7108d0c3d6b46 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33517 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33517 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh48-f69w-7vmp · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://mantisbt.org/bugs/view.php?id=36971 · Note