CVE-2026-33548

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33548
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33548.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33548
Aliases
Published
2026-03-23T19:15:18.891Z
Modified
2026-07-15T01:48:56.315933749Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
MantisBT has Stored HTML Injection / XSS when displaying Tags in Timeline
Details

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, improper escaping of tag names retrieved from History in Timeline (myviewpage.php) allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript, when displaying a tag that has been renamed or deleted. Version 2.28.1 contains a patch. Workarounds include editing offending History entries (using SQL) and wrapping $this->tag_name in a stringhtmlspecialchars() call in IssueTagTimelineEvent::html().

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33548.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/mantisbt/mantisbt

Affected ranges

Type
GIT
Repo
https://github.com/mantisbt/mantisbt
Events
Introduced
75ed0962f60435d222a04343e60ba319e12093fd
Fixed
f32787c14d4518476fe7f05f992dbfe6eaccd815
Database specific 
{
    "cpe": "cpe:2.3:a:mantisbt:mantisbt:2.28.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.28.0"
        },
        {
            "last_affected": "2.28.0"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.28.0
= 2.*
= 2.28.0
release-2.*
release-2.28.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33548.json"