GitHub Advisoryadvisory · Packagist

GHSA-rg8f-5p7x-m6wv MantisBT CSV Injection unprivileged user access in csv_export.php

HIGH Published 2022-04-15 Modified 2025-05-30 Official page ↗
Aliases
CVE-2021-43257
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-1236
Reviewed
2025-05-30

Affected packages

• Packagist mantisbt/mantisbt: < 2.25.3 → fixed in 2.25.3

Description

Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.

Related

Alias · CVE (1)

  • CVE-2021-43257 Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain… vulnerability

Weakness · CWE (1)

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File weakness

References