Executive brief
MantisBT is a popular open-source bug tracking system. A security flaw in the issue cloning process allows users with administrative or manager privileges to inject malicious scripts into the platform by naming a project with malicious code. If exploited, this could allow an attacker to perform actions on behalf of other users or access sensitive data, though the impact is partially mitigated by modern browser security policies.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in MantisBT's bug_report_page.php. When an issue is cloned from a different project, the source project's name is prepended to the category selector without adequate HTML escaping. An attacker with the ability to rename projects (typically requiring 'manager' or 'administrator' permissions) can inject arbitrary HTML/JavaScript. The vulnerability is triggered when a user views the clone issue form for an affected project. While a Content Security Policy (CSP) may restrict script execution, the underlying injection remains possible. The issue is fixed in version 2.28.2.
Affected products
- MantisBT MantisBT <= 2.28.1
Timeline
- 2026-05-09: disclosed
- 2026-05-11: advisory
- 2026-05-19: other: NVD publication