Executive brief
MantisBT, a popular open-source bug tracking system, is vulnerable to a security flaw where malicious code can be injected into saved filters. If exploited, an attacker could execute unauthorized scripts in the browsers of other users, potentially leading to data theft or account takeover. This issue specifically affects systems where the 'real name' display feature is enabled and typically requires administrative or manager-level privileges to initiate.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in MantisBT due to incorrect escaping of a saved filter's owner name. The vulnerability is triggered when the configuration option '$g_show_user_realname' is set to ON, allowing an attacker to inject arbitrary HTML/JavaScript via the owner column. While the attack vector is network-based, exploitation typically requires 'Manager' access level or higher to save filters publicly. Successful exploitation allows for arbitrary code execution in the context of a victim's browser session. A patch has been released in version 2.28.2, and workarounds include disabling the real name display or restricting filter creation permissions.
Affected products
- MantisBT MantisBT >= 2.1.0, <= 2.28.1
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory