VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 21, 2019· Updated Aug 5, 2024

CVE-2019-15074

CVE-2019-15074

Description

Stored XSS in MantisBT Timeline allows arbitrary code execution via crafted attachment filename.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Stored XSS in MantisBT Timeline allows arbitrary code execution via crafted attachment filename.

Vulnerability

Overview

CVE-2019-15074 is a stored cross-site scripting (XSS) vulnerability in the Timeline feature of Mantis Bug Tracker (MantisBT) through version 2.21.1. The flaw resides in my_view_page.php, where the filename of an uploaded attachment is displayed without proper sanitization. An attacker can upload a file with a malicious filename containing JavaScript payloads, such as ">.jpg, which is then stored and executed in the browser of any user viewing the My View Page [1][2].

Exploitation

To exploit this vulnerability, an attacker must have the ability to upload attachments to an issue that is visible to other users. No special privileges beyond standard issue reporting are required. When a victim accesses the My View Page, the crafted filename is rendered in the timeline, triggering the XSS payload. The attack is effective only if the browser's Content Security Policy (CSP) settings permit inline script execution; however, many default configurations do not block such attacks [2].

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the victim's session. This can lead to data theft, session hijacking, defacement, or other malicious actions, depending on the application's CSP settings. The vulnerability affects all users who have visibility to the issue, making it a high-severity stored XSS [1][4].

Mitigation

The MantisBT project addressed this vulnerability in commit 9cee1971c498bbe0a72bca1c773fae50171d8c27, which sanitizes the filename using string_html_specialchars() before display [4]. Users should upgrade to MantisBT version 2.21.2 or later. No workaround is available for unpatched installations; administrators should apply the patch immediately [2][4].

References
  1. NVD - CVE-2019-15074
  2. 0025995: CVE-2019-15074: Stored XSS Vulnerability in Timeline
  3. Fix XSS on timeline (CVE-2019-15074) · mantisbt/mantisbt@9cee197

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mantisbt/mantisbtPackagist
< 2.21.22.21.2

Affected products

2

Patches

1
9cee1971c498

Fix XSS on timeline (CVE-2019-15074)

https://github.com/mantisbt/mantisbtDamien RegadAug 15, 2019via ghsa
commit
1 file changed · +1 −1
  • core/classes/IssueAttachmentTimelineEvent.class.php+1 −1 modified
    @@ -73,7 +73,7 @@ public function html() {
 			. sprintf( lang_get( $t_string ),
 				prepare_user_name( $this->user_id ),
 				$t_bug_link,
-				$this->filename
+				string_html_specialchars( $this->filename )
 			)
 			. '</div>';
 		$t_html .= $this->html_end();

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.