Executive brief
MantisBT is a popular open-source bug tracking system. A vulnerability in its installation script allows attackers to inject malicious content into the application's web pages without needing to log in. This can be used to trick administrators into revealing their login credentials through fake forms or to redirect users to malicious websites, potentially compromising the entire bug tracking system and its data.
Technical details
MantisBT 2.28.3 and earlier contains six reflected Cross-Site Scripting (XSS) injection points in `/admin/install.php`. The vulnerability stems from user-supplied parameters being echoed into HTML without proper escaping via an unescaped printf format string. While a Content Security Policy (CSP) is present, it lacks a 'form-action' directive, which allows attackers to bypass script execution restrictions to perform credential phishing via form injection, CSS injection for UI manipulation, and <meta> tag open redirects. No authentication is required for exploitation. The issue is fixed in version 2.28.4.
Affected products
- MantisBT MantisBT <= 2.28.3
Timeline
- 2026-07-15: disclosed
- 2026-07-15: advisory
- 2026-07-15: patched