MantisBT install page flaw enables admin phishing

Published July 15, 2026 CVE-2026-52881

MantisBT's admin setup page has a flaw that lets attackers hide malicious code in links. If you click a fake link, it can steal your login details or hijack your session.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 2.28.4
Affected versions
2.28.3 or older
Weakness
CWE-79
Affects
MantisBT

How it works

Attackers send you a link with hidden code that MantisBT's admin/install.php page runs in your browser without cleaning it first.

What to do

Check the installed mantisbt/mantisbt version. This advisory applies to 2.28.3 or older.

Update mantisbt/mantisbt to 2.28.4 or newer. Then verify the installed version.

Technical details

Six parameters on admin/install.php are inserted into HTML via an unescaped printf format string, allowing reflected XSS. The page's CSP blocks inline scripts (script-src 'self') but lacks a form-action directive, so attackers cannot run arbitrary JS but can inject an HTML form or overlay that phishes credentials or redirects the browser to an attacker-controlled site. Fixed by escaping the db_table_prefix/db_table_plugin_prefix values with string_html_specialchars in commit 297773f, shipped in MantisBT 2.28.4.

References

View Original Source