CVE-2026-52881: MantisBT Reflected XSS Vulnerability in admin/install.php
Summary
CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf. Affects mantisbt/mantisbt versions < 2.28.4. Fixed in 2.28.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that helps teams manage and track issues efficiently. It provides features such as issue tracking, project management, and reporting tools. However, versions 2.28.3 and earlier are vulnerable to reflected Cross-Site Scripting (XSS) attacks, which can compromise the security of the application.
Vulnerability Detail
The vulnerability arises from six reflected XSS injection points in the admin/install.php file of MantisBT. User-supplied parameters are echoed into HTML without proper escaping, allowing attackers to craft malicious URLs that can execute scripts in the context of the user's browser. This can lead to credential phishing, open redirects, and UI manipulation, posing significant risks to users and administrators.
How To Fix
Minimum fixed version
2.28.4
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.28.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is recommended to remove the /admin directory from the MantisBT installation, as suggested in the Admin Guide. This can help mitigate the risk until the package is updated.
Conclusion
The reflected XSS vulnerability in MantisBT versions 2.28.3 and earlier poses significant risks to users and administrators. It is crucial to update to version 2.28.4 or later to mitigate these risks. Additionally, removing the /admin directory can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
Reflected XSS is a type of security vulnerability where an attacker injects malicious scripts into a web application, which are then executed in the user's browser when they click on a crafted link.
An attacker can exploit this vulnerability to steal admin credentials, redirect users to phishing sites, or manipulate the user interface, leading to potential data breaches.
No, the vulnerability can be exploited without any authentication, making it particularly dangerous.
The CVSS score for this vulnerability is 9.2, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
