CVE-2020-25288: An issue was discovered in MantisBT before 2.24.3.

Security readout for executives and security teams

MantisBT versions before 2.24.3 can allow injected HTML when an issue is edited in a project using a custom field with a crafted regular expression. If the site’s CSP allows it, this may become JavaScript execution in the user’s browser. Exposure is limited to MantisBT deployments before 2.24.3, especially projects using custom fields with regular expression validation. Risk depends on who can configure those fields and how restrictive the site’s CSP is. Treat this as a targeted web application hardening issue, not an emergency based on current evidence. Prioritize upgrade or validation for internet-facing MantisBT systems and environments where many users can administer custom fields. Mitigation focus: Upgrade MantisBT to version 2.24.3 or later.; Review the MantisBT issue and commit for vendor-specific fix context.; Restrict who can create or edit custom field regular expressions..

Prepared

Jun 5, 2026, 14:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.