MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php

MEDIUM 6.1CVE-2022-26144 · GHSA-rqgj-rqfr-5j6f · Published 13/04/2022 · updated 17/06/2026

In short

CVE-2022-26144 is a MEDIUM (CVSS 6.1) vulnerability affecting mantisbt/mantisbt, mantisbt (mantisbt).
Chance of exploitation in the next 30 days (EPSS): 0.83%, higher than 57.7% of all vulnerabilities.
Fix: update to 2.25.3 or later.

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.25.3`	`2.25.3`
mantisbt mantisbt	`< 2.25.3`	`2.25.3`

Description

An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-26144 · ADVISORY
mantisbt/mantisbt commit a7751c3 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/bugs/view.php · WEB

More vulnerabilities in mantisbt/mantisbt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mantisbt/mantisbt

Packagist

< 2.25.3

2.25.3

mantisbt

< 2.25.3

2.25.3

Description

NVD description

More vulnerabilities in mantisbt/mantisbt

See all →