PT-2026-27183 · Mantisbt · Mantisbt

Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-33548

NVD

CVSS v4.0

8.6

High

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (my view page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted. Version 2.28.1 contains a patch. Workarounds include editing offending History entries (using SQL) and wrapping $this->tag name in a string html specialchars() call in IssueTagTimelineEvent::html().

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33548

Affected Products

Mantisbt

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33548 · Security Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-73vx-49mv-v8w5 · Note
• https://github.com/mantisbt/mantisbt/commit/f32787c14d4518476fe7f05f992dbfe6eaccd815 · Note