Which versions of MantisBT are affected by CVE-2026-52881?

MantisBT versions 2.28.3 and earlier contain a vulnerability in the installer page that allows remote attackers to display fake login screens to harvest credentials and perform open redirects without…. A patch is available.

How to fix or mitigate CVE-2026-52881?

Within 24 hours, audit your MantisBT deployments to identify instances running version 2.28.3 or earlier and determine whether the /admin/install.php page remains accessible from the network or internet. Within 7 days, upgrade all affected instances to MantisBT 2.28.4 or later, then verify that the installer page is no longer accessible (remove or rename install.php post-deployment). Within 30 days, review access logs for any suspicious requests to /admin/install.php from untrusted sources and audit administrative account activity for signs of compromise.

MantisBT CVE-2026-52881

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-vcrw-4xvv-jh49

Open Redirect PHP XSS

Severity by source

vuln.today AI

6.1 MEDIUM

Network-reachable unauthenticated installer reflection requires the victim admin to click a link and submit a form (UI:R), crosses into the browser context (S:C), and CSP caps impact to limited phishing/redirect (C:L/I:L, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 19:01 vuln.today

Analysis Generated

Jul 15, 2026 - 19:01 vuln.today

CVE Published

Jul 15, 2026 - 18:34 cve.org

CRITICAL

DescriptionCVE.org

MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via an unescaped printf format string. No authentication is required.

A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.

Impact

Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.
Open redirect: Victim is silently redirected to a phishing or malware site.
UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering.

Patches

https://github.com/mantisbt/mantisbt/commit/297773fbb238c39a153bd888431b41a176132098

Workarounds

Remove the /admin directory, as recommended in the Admin Guide

Resources

https://mantisbt.org/bugs/view.php?id=37103
related advisory GHSA-77x8-3v3h-hrhv

Credits

McCaulay Hudson (@_McCaulay) of watchTowr

Articles & Coverage 1

News Critical XSS in MantisBT 2.28.3 via Installer Page - CVE-2026-52881 Jul 16, 2026

AnalysisAI

Reflected cross-site scripting in MantisBT 2.28.3 and earlier lets remote attackers inject HTML into the unauthenticated /admin/install.php installer page through six user-supplied parameters echoed via an unescaped printf format string. Because the application ships a script-src 'self' Content Security Policy that lacks a form-action directive, an attacker cannot run inline JavaScript but can render fake credential-harvesting login forms, perform <meta>-based open redirects, and overlay attacker HTML via CSS injection on the legitimate admin page. There is no public exploit identified at time of analysis, no CISA KEV listing, and no CVSS/EPSS score in the provided data; the issue was reported by watchTowr and fixed in 2.28.4.

Technical ContextAI

The affected component is the MantisBT installer script admin/install.php in the PHP-based MantisBT bug tracker (package pkg:composer/mantisbt/mantisbt). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): form variables (${'f_' . $t_key}) are passed directly into a printf output that emits HTML, so attacker-controlled request parameters are reflected without output encoding. The patch commit 297773fbb238c39a153bd888431b41a176132098 wraps the value in string_html_specialchars(), confirming the fix is contextual HTML-entity escaping. A partial defense-in-depth control already existed - a Content Security Policy of script-src 'self' that blocks inline/injected <script> execution - but the CSP omits a form-action directive, so injected <form> tags can post to arbitrary external origins and <meta http-equiv=refresh> redirects are unrestricted, which is why the impact is phishing/redirect rather than full script execution.

RemediationAI

Vendor-released patch: 2.28.4 - upgrade MantisBT to 2.28.4 or later, which applies commit 297773fbb238c39a153bd888431b41a176132098 to HTML-escape the reflected form values in admin/install.php (advisory: https://github.com/mantisbt/mantisbt/security/advisories/GHSA-vcrw-4xvv-jh49). If immediate upgrade is not possible, apply the vendor-recommended workaround of removing the /admin directory as described in the Admin Guide (https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.install.postcommon), which eliminates the vulnerable installer entirely; the trade-off is that admin/upgrade and installation tooling become unavailable until restored. As an additional compensating control, restrict web-server access to /admin/install.php to trusted admin source IPs and add a form-action 'self' directive to the deployed Content Security Policy so injected forms cannot post to external origins, noting this hardens phishing resistance but does not stop the underlying reflection or CSS/redirect abuse.