Which versions of PHP are affected by CVE-2026-33548?

CVE-2026-33548 presents significant security risk, a cross-site scripting vulnerability rated CVSS 8.6.. A patch is available.

How to fix or mitigate CVE-2026-33548?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

PHP CVE-2026-33548

Q: What is the CVSS score of CVE-2026-33548?

CVE-2026-33548 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-14525 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-23 GitHub_M

GHSA-73vx-49mv-v8w5

PHP XSS

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 23, 2026 - 19:30 euvd

EUVD-2026-14525

Analysis Generated

Mar 23, 2026 - 19:30 vuln.today

CVE Published

Mar 23, 2026 - 19:15 nvd

HIGH 8.6

DescriptionGitHub Advisory

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted. Version 2.28.1 contains a patch. Workarounds include editing offending History entries (using SQL) and wrapping $this->tag_name in a string_html_specialchars() call in IssueTagTimelineEvent::html().

AnalysisAI

MantisBT version 2.28.0 contains a stored cross-site scripting (XSS) vulnerability in the Timeline view of my_view_page.php where tag names are improperly escaped when retrieved from the History table, allowing attackers to inject arbitrary HTML and potentially execute JavaScript if Content Security Policy permits. This affects users viewing issues with renamed or deleted tags, and version 2.28.1 contains the patch. No CVSS score or EPSS data is currently available, but the vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries moderate to high risk in environments without strict CSP enforcement.

Technical ContextAI

The vulnerability exists in the PHP-based MantisBT application (cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*) within the IssueTagTimelineEvent class, specifically in the html() method where the $this->tag_name variable is output to the page without proper HTML entity encoding. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where user-controlled data (in this case, tag names stored in the History table) reaches the output context without sanitization. The data flows from the database History table through the Timeline rendering logic in my_view_page.php, where renamed or deleted tags retain their original names in history records but lack escaping when rendered. The recommended remediation involves wrapping $this->tag_name in the string_html_specialchars() function, which is the application's standard HTML escaping mechanism.

RemediationAI

Immediately upgrade MantisBT from version 2.28.0 to version 2.28.1 or later, using the patch available at https://github.com/mantisbt/mantisbt/commit/f32787c14d4518476fe7f05f992dbfe6eaccd815 as reference. For organizations unable to patch immediately, apply the workaround by manually editing offending History entries in the database using SQL queries to remove or sanitize malicious tag names, and apply a temporary code fix by wrapping the $this->tag_name variable in a string_html_specialchars() call within the IssueTagTimelineEvent::html() method. Additionally, enforce strict Content Security Policy (CSP) headers to prevent inline script execution, disable script sources to untrusted origins, and restrict administrative access to the MantisBT application pending patching. Monitor the official MantisBT security advisories at https://github.com/mantisbt/mantisbt/security/advisories for related vulnerabilities.