CVE-2019-15074: Mantisbt

Critical severity, CVSS 9.6. EPSS: 2.1% chance of exploitation in the next 30 days.

The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.

Affected products

• Mantisbt Mantisbt: from 2.13.0, up to and including 2.21.1

Published 2019-08-21. Last modified 2026-06-17.