Vulnerability · Published May 22, 2026 · Assigned by GitHub_M

CVE-2026-40598MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

Medium 6.9

In plain English

A medium-severity cross-site scripting in mantisbt from mantisbt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	mantisbt/mantisbt	2.28.2	GHSA-6jh4-47v2-4g37

Affected products (as reported)

Vendor	Product	Versions
mantisbt	mantisbt	< 2.28.2

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/mantisbt/mantisbt/security/advisories/GHSA-6jh4-47v2-4g37 x_refsource_CONFIRM
https://github.com/mantisbt/mantisbt/commit/b1ebc57763f104eb5f541b7b4d1ce6948168abd9 x_refsource_MISC
https://mantisbt.org/bugs/view.php?id=37017 x_refsource_MISC