MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

보통 6.9CVE-2026-40598 · GHSA-6jh4-47v2-4g37 · Published 22/05/2026 · updated 23/07/2026

요약

CVE-2026-40598은(는) mantisbt/mantisbt에 영향을 주는 보통 (CVSS 6.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.45%, 전체 취약점의 38.9%보다 높음.
조치: 2.28.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.28.2`	`2.28.2`

Description

Improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML.

While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting.

Impact

Cross-site scripting (XSS).

Patches

b1ebc57763f104eb5f541b7b4d1ce6948168abd9

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

NVD description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.

References

mantisbt/mantisbt security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-40598 · ADVISORY
mantisbt/mantisbt commit b1ebc57 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/bugs/view.php · WEB

mantisbt/mantisbt의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mantisbt/mantisbt

Packagist

< 2.28.2

2.28.2