CVE-2026-40598: MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-22 · updated 2026-07-23
Weakness: CWE-79

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.

Affected products

mantisbt: before 2.28.2

References

https://github.com/mantisbt/mantisbt/commit/b1ebc57763f104eb5f541b7b4d1ce6948168abd9
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-6jh4-47v2-4g37
https://mantisbt.org/bugs/view.php?id=37017
https://mantisbt.org/bugs/view.php?id=37017

Get alerted when CVE-2026-40598 or the next vulnerability affects your stack