CVE-2021-43257: Mantisbt

High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days.

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.

Affected products

• Mantisbt Mantisbt: before 2.25.3 (fixed in 2.25.3)

Published 2022-04-14. Last modified 2026-06-17.