GHSA-fh48-f69w-7vmp

Suggest an improvement
Source
https://github.com/advisories/GHSA-fh48-f69w-7vmp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fh48-f69w-7vmp/GHSA-fh48-f69w-7vmp.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-fh48-f69w-7vmp
Aliases
Published
2026-03-25T19:56:00Z
Modified
2026-03-25T20:26:19Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
Details

Improper escaping of Tag name when deleting it in tag_delete.php allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript.

Impact

Cross-site scripting (XSS).

Patches

80990f43153167c73f11eb4b2bc7108d0c3d6b46

Workarounds

  • Revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9
  • Manually edit language files to remove the sprintf placeholder %1$s from $s_tag_delete_message string, for example with sed -r -i '/tag_delete_message/s/.%1\$s.//' -- lang/

Credits

MantisBT hanks Vishal Shukla for discovering and responsibly reporting the issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-25T19:56:00Z",
    "nvd_published_at":  "2026-03-23T20:16:27Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist / mantisbt/mantisbt

Package

Name
mantisbt/mantisbt
Purl
pkg:composer/mantisbt/mantisbt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.28.0
Fixed
2.28.1

Affected versions

2.*
2.28.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-fh48-f69w-7vmp/GHSA-fh48-f69w-7vmp.json"