Advisory details:
github_osv / GHSA-77x8-3v3h-hrhv
| Advisory ID | github_osv/GHSA-77x8-3v3h-hrhv |
| Aliases |
CVE-2026-52847
|
| Summary | MantisBT: Reflected XSS in admin/install.php MantisBT 2.28.3 and earlier contains six reflected XSS injection points in `/admin/install.php`. User-supplied parameters are echoed into HTML without escaping via print_test_result(). No authentication is required. A Content Security Policy (script-src 'self') prevents inline JavaScript execution, but the CSP is missing a form-action directive, allowing exploitation via credential-phishing form injection and <meta> open redirects. ### Impact - Credential phishing: Attacker crafts a URL that renders a fake login form on the real MantisBT admin page. Admin credentials are submitted to an attacker-controlled server. - Open redirect: Victim is silently redirected to a phishing or malware site. - UI manipulation: CSS injection can hide legitimate page content and overlay attacker-controlled HTML, enabling social engineering. ### Patches - https://github.com/mantisbt/mantisbt/commit/0f32ceabadc745239754962df91a51d5d51e3fd7 - https://github.com/mantisbt/mantisbt/commit/f2191a0d8ce438bf74171d496cf721dae025a5c0 ### Workarounds Remove the `/admin` directory, as [recommended in the Admin Guide](https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.install.postcommon) ### Resources - https://mantisbt.org/bugs/view.php?id=37103 - related advisory [GHSA-vcrw-4xvv-jh49](https://github.com/mantisbt/mantisbt/security/advisories/GHSA-vcrw-4xvv-jh49) ### Credits McCaulay Hudson (@_McCaulay) of watchTowr |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 8.3 |
| Risk | 4.2 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 9.2 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-77x8-3v3h-hrhv/GHSA-77x8-3v3h-hrhv.json |
| generic_textual | CRITICAL |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
There are no SSVC decisions available.