CVE-2019-15539 in MantisBT
Summary
by MITRE
The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/11/2025
The vulnerability identified as CVE-2019-15539 affects the MantisBT project management system version 2.21.2 and earlier, specifically within the proj_doc_edit_page.php component of the Project Documentation feature. This represents a critical security flaw that enables attackers to inject malicious scripts into the application's web interface through carefully crafted file uploads. The vulnerability resides in how the system processes and displays filenames during document editing operations, creating an avenue for persistent cross-site scripting attacks that can compromise user sessions and execute unauthorized commands.
The technical implementation of this vulnerability stems from insufficient input validation and output sanitization within the document attachment handling mechanism. When users upload files with maliciously crafted filenames containing script tags or other XSS payloads, the system fails to properly escape or filter these inputs before rendering them in the document editing interface. This allows attackers to store malicious code within the application's documentation system, which then executes whenever the affected page is loaded or edited. The vulnerability is classified as a stored XSS issue under CWE-79, which specifically addresses the improper neutralization of input during web page generation.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable attackers to perform a wide range of malicious activities including session hijacking, data exfiltration, and privilege escalation within the affected MantisBT instance. When combined with appropriate CSP policies that may allow script execution, attackers can potentially gain full control over user sessions and execute arbitrary code on the target system. This vulnerability is particularly dangerous in enterprise environments where MantisBT is used for critical project documentation and issue tracking, as it can provide attackers with persistent access to sensitive project information and development artifacts.
Organizations using affected versions of MantisBT should immediately implement mitigations including updating to version 2.21.3 or later, which contains the necessary patches to address the XSS vulnerability. Additionally, administrators should review and strengthen their Content Security Policy configurations to limit script execution capabilities, implement proper filename validation and sanitization for uploaded attachments, and consider restricting document editing permissions to trusted users only. The ATT&CK framework categorizes this vulnerability under T1059.005 (Command and Scripting Interpreter: PowerShell) and T1566.001 (Phishing: Spearphishing Attachment), as it enables attackers to execute malicious payloads through crafted file attachments that bypass traditional security controls. Regular security assessments and input validation reviews should be conducted to prevent similar vulnerabilities from emerging in other components of the application.