要点
- CVE-2026-40596 是影响 mantisbt/mantisbt 的高危 (CVSS 7.2)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.42%，高于 36.7% 的漏洞。
- 修复：升级到 2.28.2 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| mantisbt/mantisbt Packagist | ≥ 2.11.0, < 2.28.2
| 2.28.2
|
Description
Any authenticated user can inject arbitrary HTML via updating their account's font family.
Impact
Cross-site scripting.
The injected payload will be reflected in every MantisBT page.
Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover.
Patches
- 9e8409cdd979eba86ef532756fc47c1d8112d22d
Workarounds
None
Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
NVD description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free