PT-2026-27183 · Unknown · Mantis Bug Tracker

Shukla304 · Published 2026-03-23 · Updated 2026-03-25 · CVE-2026-33548

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker versions prior to 2.28.1

Description Mantis Bug Tracker version 2.28.0 contains a flaw due to improper escaping of tag names retrieved from History in the Timeline feature, specifically within the my view page.php file. This allows an attacker to inject HTML code. If Content Security Policy (CSP) settings allow, this can lead to the execution of arbitrary JavaScript when displaying a tag that has been renamed or deleted. The vulnerable variable is $this->tag name within the IssueTagTimelineEvent::html() function.

Recommendations Update to Mantis Bug Tracker version 2.28.1 or later. As a workaround, edit the offending History entries using SQL. As a workaround, wrap $this->tag name in a string html specialchars() call within the IssueTagTimelineEvent::html() function.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-33548

GHSA-73VX-49MV-V8W5

Affected Products

Mantis Bug Tracker

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33548.json · Exploit
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-73vx-49mv-v8w5 · Vendor Advisory
• https://github.com/mantisbt/mantisbt/commit/f32787c14d4518476fe7f05f992dbfe6eaccd815 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33548 · Security Note
• https://osv.dev/vulnerability/GHSA-73vx-49mv-v8w5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33548 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://mantisbt.org/bugs/view.php?id=36973 · Note