GHSA-vcrw-4xvv-jh49: MantisBT: Reflected XSS in admin/install.php via unescaped printf
MantisBT versions 2.28.3 and earlier contain multiple reflected cross-site scripting (XSS) vulnerabilities in the /admin/install.php page due to unescaped user input in printf format strings. These vulnerabilities do not require authentication. Although a Content Security Policy restricts inline scripts, the absence of a form-action directive allows attackers to exploit the flaw for credential phishing, open redirects, and UI manipulation via CSS injection. A patch has been committed to address these issues.
AI Analysis
Technical Summary
MantisBT 2.28.3 and earlier versions have six reflected XSS injection points in the /admin/install.php file. User-supplied parameters are echoed without proper escaping through an unescaped printf format string, enabling injection of malicious content. The existing Content Security Policy limits inline JavaScript execution but lacks a form-action directive, which permits exploitation through credential phishing forms, meta tag open redirects, and CSS-based UI manipulation. No authentication is required to trigger these vulnerabilities. The issue is tracked as CVE-2026-52881 and has been fixed in version 2.28.4. Workarounds include removing the /admin directory as recommended by the MantisBT Admin Guide.
Potential Impact
An attacker can craft URLs that cause the MantisBT admin install page to render fake login forms, leading to credential theft. Victims can also be silently redirected to phishing or malware sites via open redirects. Additionally, attackers can manipulate the UI by injecting CSS to hide legitimate content and overlay attacker-controlled HTML, facilitating social engineering attacks. These impacts can compromise administrator credentials and lead to further system compromise.
Mitigation Recommendations
A fix is available in MantisBT version 2.28.4. Users should upgrade to this version or later to remediate the vulnerability. As a workaround, removing the /admin directory is recommended per the MantisBT Admin Guide. No additional mitigations are indicated by the vendor advisory.
GHSA-vcrw-4xvv-jh49: MantisBT: Reflected XSS in admin/install.php via unescaped printf
Description
MantisBT versions 2.28.3 and earlier contain multiple reflected cross-site scripting (XSS) vulnerabilities in the /admin/install.php page due to unescaped user input in printf format strings. These vulnerabilities do not require authentication. Although a Content Security Policy restricts inline scripts, the absence of a form-action directive allows attackers to exploit the flaw for credential phishing, open redirects, and UI manipulation via CSS injection. A patch has been committed to address these issues.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MantisBT 2.28.3 and earlier versions have six reflected XSS injection points in the /admin/install.php file. User-supplied parameters are echoed without proper escaping through an unescaped printf format string, enabling injection of malicious content. The existing Content Security Policy limits inline JavaScript execution but lacks a form-action directive, which permits exploitation through credential phishing forms, meta tag open redirects, and CSS-based UI manipulation. No authentication is required to trigger these vulnerabilities. The issue is tracked as CVE-2026-52881 and has been fixed in version 2.28.4. Workarounds include removing the /admin directory as recommended by the MantisBT Admin Guide.
Potential Impact
An attacker can craft URLs that cause the MantisBT admin install page to render fake login forms, leading to credential theft. Victims can also be silently redirected to phishing or malware sites via open redirects. Additionally, attackers can manipulate the UI by injecting CSS to hide legitimate content and overlay attacker-controlled HTML, facilitating social engineering attacks. These impacts can compromise administrator credentials and lead to further system compromise.
Mitigation Recommendations
A fix is available in MantisBT version 2.28.4. Users should upgrade to this version or later to remediate the vulnerability. As a workaround, removing the /admin directory is recommended per the MantisBT Admin Guide. No additional mitigations are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vcrw-4xvv-jh49
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-52881"]
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
Threat ID: 6a58b44468715ace43d6ad84
Added to database: 07/16/2026, 10:36:52 UTC
Last enriched: 07/16/2026, 11:23:14 UTC
Last updated: 07/16/2026, 11:43:36 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.