GHSA-fh48-f69w-7vmpHigh

MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation

Published
March 25, 2026
Last Modified
March 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-33517 →

📋 Description

Improper escaping of Tag name when deleting it in tag_delete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.

Impact

Cross-site scripting (XSS).

Patches

80990f43153167c73f11eb4b2bc7108d0c3d6b46

Workarounds

  • Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9
  • Manually edit language files to remove the sprintf placeholder %1$s from $s_tag_delete_message string, for example with sed -r -i '/tag_delete_message/s/.%1\$s.//' -- lang/

Credits

MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.

🎯 Affected products1

  • composer/mantisbt/mantisbt:= 2.28.0

🔗 References (6)