Which versions of MantisBT are affected by CVE-2026-52847?

MantisBT versions 2.28.3 and earlier contain a critical, unauthenticated vulnerability in the admin installation page enabling attackers to steal administrative credentials and compromise the entire…. A patch is available.

How to fix or mitigate CVE-2026-52847?

Within 24 hours, identify all MantisBT deployments in your environment and confirm which versions are running; prioritize those with versions 2.28.3 and earlier where the installation page (/admin/install.php) is accessible over the network. Within 7 days, apply the vendor-released patch to all affected instances and verify the update is deployed across production and non-production environments. Within 30 days, conduct a security audit to identify whether the installation page was publicly exposed during the vulnerability window and review access logs for suspicious activities targeting the admin installation endpoint.

MantisBT CVE-2026-52847

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-77x8-3v3h-hrhv

PHP XSS Open Redirect

Severity by source

vuln.today AI

6.1 MEDIUM

Network-reachable unauthenticated reflected XSS needing victim interaction (UI:R) with a scope change into the admin origin; CSP limits impact to low confidentiality/integrity, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 18:47 vuln.today

Analysis Generated

Jul 15, 2026 - 18:47 vuln.today

CVE Published

Jul 15, 2026 - 18:25 cve.org

CRITICAL

DescriptionCVE.org

MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required.

A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.

Impact

Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.
Open redirect: Victim is silently redirected to a phishing or malware site.
UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering.

Patches

https://github.com/mantisbt/mantisbt/commit/0f32ceabadc745239754962df91a51d5d51e3fd7
https://github.com/mantisbt/mantisbt/commit/f2191a0d8ce438bf74171d496cf721dae025a5c0

Workarounds

Remove the /admin directory, as recommended in the Admin Guide

Resources

https://mantisbt.org/bugs/view.php?id=37103
related advisory GHSA-vcrw-4xvv-jh49

Credits

McCaulay Hudson (@_McCaulay) of watchTowr

Articles & Coverage 1

News Critical Reflected XSS in MantisBT Admin Install Page - CVE-2026-52847 Jul 16, 2026

AnalysisAI

Reflected cross-site scripting in MantisBT's /admin/install.php (versions 2.28.3 and earlier) lets remote attackers inject HTML through six unescaped, user-supplied parameters echoed by print_test_result(). Although the page's Content-Security-Policy (script-src 'self') blocks inline JavaScript, the missing form-action directive permits credential-phishing form injection, <meta>-based open redirects, and CSS overlay attacks against the trusted admin origin. The advisory states no authentication is required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

MantisBT is a widely used PHP-based open-source bug-tracking application (packaged as composer/mantisbt/mantisbt). The flaw is a classic CWE-79 Improper Neutralization of Input During Web Page Generation: the installer helper function print_test_result() concatenated attacker-controlled request parameters directly into the HTML response ('<br>' . $p_message) without output encoding. The fix in commit 0f32cea wraps the message in string_html_specialchars(), neutralizing the injected markup. Notably the deployment ships a partial CSP - script-src 'self' stops reflected inline <script>/event-handler execution - but because CSP form-action was not set, injected <form> elements can post to arbitrary external hosts and <meta http-equiv=refresh> redirects are unrestricted, so the missing directive converts an otherwise script-neutered XSS into a usable phishing and open-redirect primitive.

RemediationAI

Vendor-released patch: upgrade to MantisBT 2.28.4, which applies output encoding via string_html_specialchars() in print_test_result() (commits 0f32ceabadc745239754962df91a51d5d51e3fd7 and f2191a0d8ce438bf74171d496cf721dae025a5c0). If immediate upgrade is not possible, the vendor-recommended workaround is to remove the /admin directory after installation per the Admin Guide (https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.install.postcommon); this eliminates the vulnerable installer entirely with the trade-off that you must temporarily restore it to run future upgrades or diagnostics. As an additional compensating control, restrict access to /admin/install.php at the web-server or WAF layer (IP allow-listing or authentication) and add a CSP form-action 'self' directive to blunt the phishing and redirect vector, noting this does not fix the underlying reflection. See advisory GHSA-77x8-3v3h-hrhv for the canonical fix guidance.