MantisBT has Stored HTML Injection/XSS when displaying Tags in Timeline

中 6.1CVE-2026-33548 · GHSA-73vx-49mv-v8w5 · 23/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-33548 は mantisbt/mantisbt, mantisbt (mantisbt) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.20%（全脆弱性の 9.8% より高い）。
対処：2.28.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
mantisbt/mantisbt Packagist	`≥ 2.28.0, < 2.28.2`	`2.28.2`
mantisbt mantisbt	`= 2.28.0`	修正版なし

概要

Improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted.

Impact

Cross-site scripting (XSS).

Patches

f32787c14d4518476fe7f05f992dbfe6eaccd815

Workarounds

Edit offending History entries (using SQL)
Wrap $this->tag_name in a string_html_specialchars() call in IssueTagTimelineEvent::html()

Credits

MantisBT thanks Vishal Shukla for discovering and responsibly reporting the issue.

NVD の説明

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (my_view_page.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted. Version 2.28.1 contains a patch. Workarounds include editing offending History entries (using SQL) and wrapping `$this->tag_name` in a string_html_specialchars() call in IssueTagTimelineEvent::html().