MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline

Vulnerability

Overview

CVE-2026-33548 is a stored cross-site scripting (XSS) vulnerability in Mantis Bug Tracker (MantisBT) version 2.28.0. The root cause is improper escaping of tag names retrieved from the History table when displayed in the Timeline on my_view_page.php. When a tag is renamed or deleted, the old tag name is fetched from history and rendered without sanitization, allowing an attacker to inject arbitrary HTML and, if Content Security Policy (CSP) settings permit, execute JavaScript [1][2][4].

Exploitation

An attacker can exploit this by first creating an issue with a tag containing malicious HTML or JavaScript (e.g., timeline). Then, by renaming or deleting that tag, the original malicious name is stored in the history. When any user views the Timeline on the homepage, the injected payload is rendered, leading to script execution if CSP is not restrictive enough [2]. The vulnerability is triggered without requiring authentication beyond a standard user account that can create and modify tags.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, data theft, defacement, or further attacks against other users. The vulnerability is classified as stored XSS with high impact on confidentiality, integrity, and availability [1][4].

Mitigation

The issue is fixed in MantisBT version 2.28.1. For users who cannot upgrade immediately, workarounds include manually editing offending History entries via SQL or modifying the source code to wrap $this->tag_name in a string_html_specialchars() call in IssueTagTimelineEvent::html() [1][4]. The advisory credits Vishal Shukla for responsible disclosure [4].