CVE-2026-33517CWE-79

MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation

High · published March 23, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Version 2.28.1 fixes the issue. Workarounds include reverting commit d6890320752ecf37bd74d11fe14fe7dc12335be9 and/or manually editing language files to remove the sprintf placeholder `%1$s` from `$s_tag_delete_message` string.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00364 · 29.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-23T19:13Z
EPSS history
Timeline
  • 23 MAR 19:13Z
    MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
    cvelistv5