GitHub Advisoryadvisory · Packagist

GHSA-f633-865q-2mhh MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

HIGH Published 2026-05-11 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-40607
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2026-05-11

Affected packages

• Packagist mantisbt/mantisbt: >= 2.1.0, < 2.28.2 → fixed in 2.28.2

Description

Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON. Impact Cross-site scripting (XSS). Note that By default, only users with *Manager* access level or above can save their filters publicly Patches • 44f490bcf20fd491c1b8f3fc9dd041d8c2a30010 Workarounds • Prevent display of users' real name (set `$g_ show_user_realname = OFF;` in configuration) • Restrict ability to store filters (set $`g_stored_query_create_threshold` / $`g_stored_query_create_shared_threshold` to `NOBODY` Credits Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

Related

Alias · CVE (1)

  • CVE-2026-40607 Mantis Bug Tracker (MantisBT) is an open source issue tracker. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References