EUVD-2026-31192
GHSA-qj6w-v29q-4rgx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered stored XSS requiring authenticated low-privilege attacker and victim page load; scope changes to victim browser context justifying S:C with limited C and I impact.
Primary rating from Vendor (https://github.com/mantisbt/mantisbt).
CVSS VectorVendor: https://github.com/mantisbt/mantisbt
Lifecycle Timeline
3DescriptionCVE.org
Improper escaping of a textarea custom field's contents in the Update Issue page (bug_update_page.php) allows an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded.
Impact
Session theft leading to admin account takeover, full project data access.
- Precondition: A textarea-type custom field must be configured for the project
- Attacker: Authenticated user with bug report permission (low privilege)
- Victim: Any user viewing the bug edit form, including administrators
Patches
- 5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7
Workarounds
The default Content-Security Policy will block script execution.
References
- https://mantisbt.org/bugs/view.php?id=37003
- This is related to CVE-2024-34081.
Credits
Thanks to the following security researchers for independently discovering and responsibly reporting the issue, and providing a patch to fix it.
- Thanks to Nozomu Sasaki (Paul) (@morimori-dev)
- Tristan Madani (@TristanInSec) from Talence Security
AnalysisAI
Stored XSS in MantisBT's bug update page (bug_update_page.php) allows a low-privileged authenticated reporter to inject arbitrary HTML - and JavaScript where CSP is not enforced - into textarea-type custom field values, which execute in any victim's browser upon loading the Update Issue form. The impact chain reaches session theft and full administrative takeover of the MantisBT instance. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS at 0.03% (10th percentile) reflects very low current exploitation probability; however, the attacker-controlled payload persists until the bug is edited and the preconditions for exploitation are common among MantisBT deployments that use custom fields.
Technical ContextAI
MantisBT is an open-source PHP-based bug and issue tracking system (composer package mantisbt/mantisbt). The flaw resides in core/cfdefs/cfdef_standard.php within the cfdef_input_textarea() function, which rendered a custom field's stored value directly inside a <textarea> HTML element without HTML entity encoding. The commit diff confirms the fix was a single-character change: wrapping $p_custom_field_value with string_textarea() before output. This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) pattern: unsanitized user-controlled data travels from storage to rendered HTML context. The vulnerability is structurally related to CVE-2024-34081, a prior stored XSS in MantisBT (GHSA-wgx7-jp56-65mq), indicating a recurring pattern of missing output encoding on custom field rendering. Affected CPE: pkg:composer/mantisbt/mantisbt versions ≤ 2.28.1.
RemediationAI
Upgrade MantisBT to version 2.28.2 or later; this release contains commit 5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7 (https://github.com/mantisbt/mantisbt/commit/5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7), which adds proper HTML escaping via string_textarea() to textarea custom field rendering. For deployments that cannot immediately upgrade, confirm that MantisBT's default Content-Security Policy is active and untouched - the default CSP blocks inline script execution, which prevents JavaScript from running even if the HTML injection is present, though HTML-only injection (e.g., phishing links, UI spoofing) remains possible as a residual risk. As a secondary mitigation, removing all textarea-type custom fields from projects eliminates the attack surface entirely at the cost of losing that field type for legitimate use. The full security advisory is available at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-qj6w-v29q-4rgx.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today