Is there a patch available for EUVD-2026-33024?

Yes, a patch is available for EUVD-2026-33024. Update the affected software to the latest version immediately.

MantisBT EUVD-2026-33024

Q: What is the CVSS score of EUVD-2026-33024?

EUVD-2026-33024 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-41897 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 https://github.com/mantisbt/mantisbt

GHSA-j7v9-f46r-2rp4

PHP XSS

5.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Reflected XSS requires victim to process a crafted request (UI:R); scope changes to victim browser context (S:C); PR:L confirmed by vendor CVSS 4.0; no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:48 vuln.today

Analysis Generated

Jul 23, 2026 - 23:48 vuln.today

CVSS changed

May 28, 2026 - 21:22 NVD

5.3 (MEDIUM)

CVE Published

May 11, 2026 - 19:39 nvd

MEDIUM

DescriptionGitHub Advisory

Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field.

Impact

Cross-site scripting (XSS)

Patches

c885af13f0b8596714ffe11df757c09f35fbd8f4

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

AnalysisAI

Reflected XSS in MantisBT versions 1.0.0 through 2.28.1 allows an authenticated low-privilege attacker to inject arbitrary HTML into the View Issues Page by supplying a malicious value in the unvalidated filter_target parameter of the return_dynamic_filters.php AJAX endpoint, exploitable specifically when the target resolves to a TEXTAREA-type custom field. The vendor's CVSS 4.0 vector confirms low-privilege authentication is required and impact is limited to low confidentiality and integrity loss against victim users. No public exploit has been identified and EPSS probability stands at 0.04%, placing this firmly in the low-urgency tier despite its network accessibility; patch version 2.28.2 is confirmed available.

Technical ContextAI

MantisBT is an open-source PHP bug-tracking system distributed via Composer (pkg:composer/mantisbt/mantisbt). The vulnerable component is return_dynamic_filters.php, an AJAX endpoint invoked by the View Issues Page to dynamically render filter UI widgets for custom fields. The filter_target parameter - intended to identify a custom field by its numeric ID - is passed unsanitized to print_filter_custom_field() in core/filter_form_api.php, where it is interpolated directly into HTML attribute values (e.g., name="custom_field_<ID>") without numeric validation or HTML encoding. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: attacker-controlled HTTP input flows into HTML output without escaping. The commit diff for c885af13 reveals two layers of fix: a numeric guard if( !is_numeric( $t_custom_id ) ) added in return_dynamic_filters.php that throws a ClientException on non-numeric input, and string_html_specialchars() encoding applied to field IDs in filter_form_api.php to prevent attribute injection. The additional changes in core/date_api.php apply the same encoding discipline to date-picker select element names, reflecting a broader HTML-injection hardening sweep in this release.

RemediationAI

Upgrade MantisBT to version 2.28.2, the confirmed fixed release per the GitHub advisory GHSA-j7v9-f46r-2rp4 (https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j7v9-f46r-2rp4) and patch commit c885af13f0b8596714ffe11df757c09f35fbd8f4 (https://github.com/mantisbt/mantisbt/commit/c885af13f0b8596714ffe11df757c09f35fbd8f4). The vendor confirms no official workarounds exist. As a temporary compensating control prior to patching, deploy a WAF rule rejecting non-numeric values in the filter_target (or equivalent custom field ID) parameter on requests to return_dynamic_filters.php; note this may break AJAX dynamic filter rendering for any deployment using non-numeric field identifiers, requiring testing before enforcement. Restricting MantisBT to authenticated internal users via network controls reduces the attacker pool but does not eliminate the vulnerability since PR:L is already required. Disabling TEXTAREA-type custom fields removes the specific injection pathway but disrupts legitimate workflow customization in affected instances.