Medium severity · published Mar 23, 2026
CVE-2026-33517
MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Version 2.28.1 fixes the issue. Workarounds include reverting commit d6890320752ecf37bd74d11fe14fe7dc12335be9 and/or manually editing language files to remove the sprintf placeholder `%1$s` from `$s_tag_delete_message` string.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mantisbt · mantisbt
= 2.28.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33517
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33517
Patch
https://github.com/mantisbt/mantisbt/commit/80990f43153167c73f11eb4b2bc7108d0c3d6b46
Patch
https://github.com/mantisbt/mantisbt/commit/d6890320752ecf37bd74d11fe14fe7dc12335be9
Mitigation
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fh48-f69w-7vmp
More from mantisbt
9.8
CVE-2026-30849
MantisBT SOAP API has an authentication bypass vulnerability on MySQL
9.6
CVE-2019-15074
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings…
9.3
CVE-2026-47156
MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
9.1
CVE-2025-47776
MantisBT: Authentication bypass for some passwords due to PHP type juggling
8.8
CVE-2017-7615
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php