CVE-2026-52881
MantisBT: Reflected XSS in admin/install.php via unescaped printf
MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via an unescaped printf format string. No authentication is required.
A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.
Impact
- Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.
- Open redirect: Victim is silently redirected to a phishing or malware site.
- UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering.
Patches
Workarounds
Remove the /admin directory, as recommended in the Admin Guide
Resources
- https://mantisbt.org/bugs/view.php?id=37103
- related advisory GHSA-77x8-3v3h-hrhv
Credits
McCaulay Hudson (@_McCaulay) of watchTowr
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-vcrw-4xvv-jh49
MantisBT: Reflected XSS in admin/install.php via unescaped printf
MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via an unescaped printf format string. No authentication is required.
A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.
Impact
- Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.
- Open redirect: Victim is silently redirected to a phishing or malware site.
- UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering.
Patches
Workarounds
Remove the /admin directory, as recommended in the Admin Guide
Resources
- https://mantisbt.org/bugs/view.php?id=37103
- related advisory GHSA-77x8-3v3h-hrhv
Credits
McCaulay Hudson (@_McCaulay) of watchTowr
- Record
GHSA-vcrw-4xvv-jh49- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vcrw-4xvv-jh49
MantisBT: Reflected XSS in admin/install.php via unescaped printf
MantisBT 2.28.3 and earlier contains six reflected XSS injection points in /admin/install.php. User-supplied parameters are echoed into HTML without escaping via an unescaped printf format string. No authentication is required.
A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects.
Impact
- Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server.
- Open redirect: Victim is silently redirected to a phishing or malware site.
- UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering.
Patches
Workarounds
Remove the /admin directory, as recommended in the Admin Guide
Resources
- https://mantisbt.org/bugs/view.php?id=37103
- related advisory GHSA-77x8-3v3h-hrhv
Credits
McCaulay Hudson (@_McCaulay) of watchTowr
- Record
GHSA-vcrw-4xvv-jh49- CVSS 4.0
- 9.2 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mantisbt/mantisbtPackagist |
through 2.28.3 | 2.28.4 |
mantisbt/mantisbtPackagist |
before 2.28.4, plus listed versions 2.10.02.10.12.11.02.11.12.12.0 Show 45 moreShow less2.12.12.12.22.13.02.13.12.13.22.14.02.15.02.15.12.16.02.16.12.17.02.17.12.17.22.18.02.18.12.19.02.19.12.20.02.20.12.21.02.21.12.21.22.21.32.22.02.22.12.22.22.23.02.23.12.24.02.24.12.24.22.24.32.24.42.24.52.25.02.25.12.25.22.25.32.25.42.25.52.25.62.25.72.25.82.26.02.26.1 |
2.28.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-52881 is a critical vulnerability (CVSS 9.2) in mantisbt/mantisbt, published July 15, 2026. No source lists public exploit code. Fixed in mantisbt/mantisbt 2.28.4.
References
Left out here: 28 versions. The JSON record has them.