GHSA-73vx-49mv-v8w5HighCVSS 6.1

MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline

Published
March 25, 2026
Last Modified
March 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-33548 →

📋 Description

Improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.

Impact

Cross-site scripting (XSS).

Patches

f32787c14d4518476fe7f05f992dbfe6eaccd815

Workarounds

  • Edit offending History entries (using SQL)
  • Wrap $this->tag_name in a string_html_specialchars() call in IssueTagTimelineEvent::html()

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

🎯 Affected products1

  • composer/mantisbt/mantisbt:= 2.28.0

🔗 References (5)