MantisBT XSS through crafted SVG documents in file_download.php

MEDIUM 5.4CVE-2022-33910 · GHSA-qghg-v7xv-q98q · Published 24/06/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.25.5`	`2.25.5`
mantisbt mantisbt	`< 2.25.5`	`2.25.5`

Description

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-33910 · ADVISORY
mantisbt/mantisbt commit 2667621 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/blog/archives/mantisbt/719 · WEB
mantisbt.org/bugs/view.php · WEB
mantisbt.org/bugs/view.php · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free