MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.phpGHSA-wfg2-2wmw-6894
MEDIUMGHSA-wfg2-2wmw-6894 is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in mantisbt/mantisbt. 3 public exploit or proof-of-concept references are indexed, so weaponization risk is real. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
mantisbt/mantisbtReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
An XSS issue was discovered in browser_search_plugin.php in MantisBT up to and including 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | mantisbt/mantisbt | all versions | No fix |
Affected Products
mantisbtmantisbtResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mantisbt/mantisbt, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of mantisbt/mantisbt for GHSA-wfg2-2wmw-6894. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
How to detect GHSA-wfg2-2wmw-6894
A community-maintained Nuclei template exists for this CVE. You can scan for it directly:
nuclei -id ghsa-wfg2-2wmw-6894 -u https://target- Template
- MantisBT < 2.25.2 - Cross-Site Scripting
- Severity
- medium
- Impact
- Successful exploitation allows attackers to execute arbitrary JavaScript code in the context of a victim's browser,potentially leading to session hijacking, credential theft, or phishing attacks.
- Remediation
- Upgrade to MantisBT version 2.25.2 or later which contains the fix for this vulnerability.If upgrading is not immediately possible, restrict access to the browser_search_plugin.php endpoint.
Template by ProjectDiscovery nuclei-templates (ritikchaddha), MIT licensed. View the full template. Scan only systems you are authorised to test.
Frequently Asked Questions
Is GHSA-wfg2-2wmw-6894 in your dependencies?
Find it across Packagist, including transitive dependencies.