Mantis Bug Tracker (MantisBT) is an open source issue tracker.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 23, 2026 · NIST NVD

   Detected

   Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Version 2.28.1 fixes the issue. Workarounds include reverting commit d6890320752ecf37bd74d11fe14fe7dc12

2. Jun 17, 2026 · NIST NVD

   Updated

   Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript. Version 2.28.1 fixes the issue. Workarounds include reverting commit d6890320752ecf37bd74d11fe14fe7dc12

Affected

• cpe mantisbt/mantisbt2.28.0

Sources

• CVE.orgVulnerability recordCVE-2026-33517

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-33517

  Mantis Bug Tracker (MantisBT) is an open source issue tracker. In version 2.28.0, when deleting a Tag (tag_delete.php), improper escaping of its name when displaying the confirmation message allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbit

  nvd.nist.gov

References

• Patch · github.com
• Patch · github.com
• Mitigation · github.com