Mantisbt CVE-2026-33548

Requires authenticated user login to MantisBT 2.28.0. Victim must view the Timeline/History section in my_view_page.php displaying a renamed or deleted tag. Attacker injects malicious HTML/JavaScript into tag name; execution depends on CSP settings permitting inline scripts.

The real-world risk is moderate to high despite the absence of a CVSS score or EPSS data. The attack vector is network-based and requires no special privileges (any user viewing an issue with a renamed/deleted tag can trigger the vulnerability), making it easily exploitable. The technical complexity is low—the vulnerability is stored XSS triggered by simply viewing the Timeline, requiring no user interaction beyond visiting a page. The impact depends critically on CSP configuration: in environments with weak or absent CSP headers, arbitrary JavaScript execution is possible, leading to session hijacking, credential theft, or administrative actions. However, modern deployments with strict CSP may limit exploitation to HTML injection without script execution. The patch availability in 2.28.1 and the presence of a public GitHub security advisory indicate this has received vendor attention. The lack of evidence of active in-the-wild exploitation or public POC code, combined with the requirement to view specific historical tag changes, suggests this is a lower-urgency priority than a pre-authentication RCE, but organizations running 2.28.0 should still prioritize patching to eliminate the attack surface entirely.

An attacker with MantisBT user access (or any user on a public instance) creates a tag with an embedded HTML/JavaScript payload such as '<img src=x onerror="alert(document.cookie)">'. When another user (especially an administrator) views the issue's Timeline after the tag is renamed or deleted, the malicious tag name is rendered without escaping in the History section, executing the injected JavaScript if CSP permits. This could allow the attacker to steal session tokens, perform unauthorized administrative actions, or inject further malicious content. No public proof-of-concept code has been identified, but the vulnerability is trivial to exploit for any authenticated user with tag management permissions.