CVE-2026-39960 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custom field's contents in the Update Issue page, (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover, full project data access. In order to exploit this issue, a textarea-type custom field must be configured for the project, the attack must be carried out by an authenticated user with bug report permission (low privilege). This can affect any user viewing the bug edit form, including administrators. The issue has been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using the default Content-Security Policy, which blocks script execution.
A stored cross-site scripting vulnerability has been identified in Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier. The issue arises from improper escaping of textarea custom field contents on the Update Issue page, allowing an authenticated user with bug report permission to inject HTML. If the Content Security Policy (CSP) settings permit, this injected HTML could be used to execute arbitrary JavaScript when the page is loaded. The vulnerability could lead to session theft, allowing an attacker to take over an admin account and gain full access to project data. This issue affects any user viewing the bug edit form, including administrators.
Users can upgrade to MantisBT version 2.28.2, where this vulnerability has been patched. If an immediate upgrade is not possible, the issue can be mitigated by using the default Content-Security Policy, which blocks script execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 20, 2026CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/5fec0f448b7a7d7d539a6adb6dccceac4e4e4ab7 | [email protected] | Source CodeVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-qj6w-v29q-4rgx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mantis Bug Tracker | <= 2.28.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | New CVE Received | [email protected] |