CVE-2026-33548CWE-79

MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline

High · published March 23, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted. Version 2.28.1 contains a patch. Workarounds include editing offending History entries (using SQL) and wrapping `$this->tag_name` in a string_html_specialchars() call in IssueTagTimelineEvent::html().

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00297 · 21.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-23T19:15Z
EPSS history
Timeline
  • 23 MAR 19:15Z
    MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline
    cvelistv5