CVE-2020-25830: An issue was discovered in MantisBT before 2.24.3.

Security readout for executives and security teams

MantisBT versions before 2.24.3 can mishandle a custom field name. A crafted name can inject HTML into a page used for bulk issue updates, and JavaScript may run if the site’s CSP allows it. The main business risk is user session compromise or misleading content inside the bug tracker. Organizations running MantisBT before 2.24.3 are potentially exposed, especially where users can create or modify custom field names and CSP is permissive. Public internet exposure increases concern, but the bundle does not confirm default exploitability or required permissions. Treat as a targeted web application security fix, not an emergency based on current evidence. Prioritize upgrade for internet-facing or broadly used MantisBT systems because successful exploitation could affect trusted users inside issue-tracking workflows. Mitigation focus: Upgrade MantisBT to 2.24.3 or later.; Review the MantisBT issue and linked commit for vendor context.; Restrict custom field administration to trusted users..

Prepared

Jun 5, 2026, 14:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.