MantisBT setup page bug enables admin credential phishing

Published July 15, 2026 CVE-2026-52847

MantisBT's setup page has a flaw that lets attackers trick you into giving them your admin password. Attackers can send you a fake login page that steals your credentials.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 2.28.4
Affected versions
2.28.3 or older
Weakness
CWE-79
Affects
MantisBT

How it works

Attackers send you a fake login link that tricks your browser into running malicious code when you try to log in to MantisBT's setup page.

What to do

Check the installed mantisbt/mantisbt version. This advisory applies to 2.28.3 or older.

Update mantisbt/mantisbt to 2.28.4 or newer. Then verify the installed version.

Technical details

CVE-2026-52847 covers six reflected XSS injection points in MantisBT's admin/install.php, reached through the print_test_result function, which echoes user-supplied parameters into HTML without escaping and requires no authentication. MantisBT ships a Content Security Policy restricting inline script execution, which blocks classic script-tag XSS, but the policy has no form-action directive. That gap lets an attacker inject an HTML form or CSS overlay instead of a script, enabling credential-phishing forms, open redirects, and UI-overlay social engineering on the real admin page. Fixed in MantisBT 2.28.4; commits are linked in the GitHub advisory.

References

View Original Source