GitHub Advisoryadvisory · Packagist
GHSA-7mqj-8gj2-cg59 MantisBT has Stored XSS on Move Attachments Admin Page
HIGH
Official page ↗
- Aliases
- CVE-2026-44655
- Ecosystem
- Packagist
- Packages
- mantisbt/mantisbt
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-79
- Reviewed
- 2026-05-11
Affected packages
• Packagist mantisbt/mantisbt: >= 1.3.0, < 2.28.2 → fixed in 2.28.2
Description
Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page.
Impact
Cross-site scripting (XSS).
This is mitigated by Content Security Policy which restricts scripts execution.
Patches
• 5cb4b469295889f5d2b01677c9bf82c143e0fdaa
Workarounds
None
Related
Alias · CVE (1)
- CVE-2026-44655 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-7mqj-8gj2-cg59 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-44655 advisory
- https://github.com/mantisbt/mantisbt/commit/5cb4b469295889f5d2b01677c9bf82c143e0fdaa web
- https://github.com/mantisbt/mantisbt package
- https://mantisbt.org/bugs/view.php?id=37099 web