EUVD-2026-33024
GHSA-j7v9-f46r-2rp4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS requires victim to process a crafted request (UI:R); scope changes to victim browser context (S:C); PR:L confirmed by vendor CVSS 4.0; no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field.
Impact
Cross-site scripting (XSS)
Patches
- c885af13f0b8596714ffe11df757c09f35fbd8f4
Workarounds
None
Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
AnalysisAI
Reflected XSS in MantisBT versions 1.0.0 through 2.28.1 allows an authenticated low-privilege attacker to inject arbitrary HTML into the View Issues Page by supplying a malicious value in the unvalidated filter_target parameter of the return_dynamic_filters.php AJAX endpoint, exploitable specifically when the target resolves to a TEXTAREA-type custom field. The vendor's CVSS 4.0 vector confirms low-privilege authentication is required and impact is limited to low confidentiality and integrity loss against victim users. No public exploit has been identified and EPSS probability stands at 0.04%, placing this firmly in the low-urgency tier despite its network accessibility; patch version 2.28.2 is confirmed available.
Technical ContextAI
MantisBT is an open-source PHP bug-tracking system distributed via Composer (pkg:composer/mantisbt/mantisbt). The vulnerable component is return_dynamic_filters.php, an AJAX endpoint invoked by the View Issues Page to dynamically render filter UI widgets for custom fields. The filter_target parameter - intended to identify a custom field by its numeric ID - is passed unsanitized to print_filter_custom_field() in core/filter_form_api.php, where it is interpolated directly into HTML attribute values (e.g., name="custom_field_<ID>") without numeric validation or HTML encoding. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: attacker-controlled HTTP input flows into HTML output without escaping. The commit diff for c885af13 reveals two layers of fix: a numeric guard if( !is_numeric( $t_custom_id ) ) added in return_dynamic_filters.php that throws a ClientException on non-numeric input, and string_html_specialchars() encoding applied to field IDs in filter_form_api.php to prevent attribute injection. The additional changes in core/date_api.php apply the same encoding discipline to date-picker select element names, reflecting a broader HTML-injection hardening sweep in this release.
RemediationAI
Upgrade MantisBT to version 2.28.2, the confirmed fixed release per the GitHub advisory GHSA-j7v9-f46r-2rp4 (https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j7v9-f46r-2rp4) and patch commit c885af13f0b8596714ffe11df757c09f35fbd8f4 (https://github.com/mantisbt/mantisbt/commit/c885af13f0b8596714ffe11df757c09f35fbd8f4). The vendor confirms no official workarounds exist. As a temporary compensating control prior to patching, deploy a WAF rule rejecting non-numeric values in the filter_target (or equivalent custom field ID) parameter on requests to return_dynamic_filters.php; note this may break AJAX dynamic filter rendering for any deployment using non-numeric field identifiers, requiring testing before enforcement. Restricting MantisBT to authenticated internal users via network controls reduces the attacker pool but does not eliminate the vulnerability since PR:L is already required. Disabling TEXTAREA-type custom fields removes the specific injection pathway but disrupts legitimate workflow customization in affected instances.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today