In short
- CVE-2026-40596 is a HIGH (CVSS 7.2) vulnerability affecting mantisbt/mantisbt.
- Chance of exploitation in the next 30 days (EPSS): 0.42%, higher than 36.7% of all vulnerabilities.
- Fix: update to 2.28.2 or later.
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.11.0, < 2.28.2
| 2.28.2
|
Description
Any authenticated user can inject arbitrary HTML via updating their account's font family.
Impact
Cross-site scripting.
The injected payload will be reflected in every MantisBT page.
Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover.
Patches
- 9e8409cdd979eba86ef532756fc47c1d8112d22d
Workarounds
None
Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
NVD description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2.
More vulnerabilities in mantisbt/mantisbt
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free