GitHub Advisoryadvisory · Packagist

GHSA-6jh4-47v2-4g37 MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

MEDIUM Published 2026-05-11 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-40598
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2026-05-11

Affected packages

• Packagist mantisbt/mantisbt: < 2.28.2 → fixed in 2.28.2

Description

Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. Impact Cross-site scripting (XSS). Patches • b1ebc57763f104eb5f541b7b4d1ce6948168abd9 Workarounds None Credits Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

Related

Alias · CVE (1)

  • CVE-2026-40598 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References