CVE-2022-33910: MantisBT XSS through crafted SVG documents in file_download.php

June 25, 2022 (updated June 11, 2025)

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.

References

github.com/advisories/GHSA-qghg-v7xv-q98q
github.com/mantisbt/mantisbt
github.com/mantisbt/mantisbt/commit/266762193fc6c09ffc6b14f5a34c86eae3ebee20
mantisbt.org/blog/archives/mantisbt/719
mantisbt.org/bugs/view.php?id=29135
mantisbt.org/bugs/view.php?id=30384
nvd.nist.gov/vuln/detail/CVE-2022-33910

Code Behaviors & Features

Detect and mitigate CVE-2022-33910 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →