PT-2026-39875 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-19 · CVE-2026-34463

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker (MantisBT) versions prior to 2.28.2

Description A Stored Cross-Site Scripting (XSS) issue exists when cloning an issue from a project other than the current one. The clone form 'bug report page.php' prepends the source project name before the category selector without proper escaping. This allows an attacker with manager or administrator privileges to inject HTML by modifying the project name. Content Security Policy (CSP), a security layer that helps detect and mitigate certain types of attacks including XSS, restricts script execution in this case.

Recommendations Update to version 2.28.2. Ensure project names do not contain any HTML tags.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34463

GHSA-FVJF-68WH-RWP2

Affected Products

Mantisbt

References · 8

• https://osv.dev/vulnerability/GHSA-fvjf-68wh-rwp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34463 · Security Note
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fvjf-68wh-rwp2 · Note
• https://github.com/mantisbt/mantisbt/commit/df22697ae497ddd93f3d9132fdf4979db8d081cd · Note
• https://t.me/CVEtracker/54296 · Telegram Post
• https://twitter.com/CVEnew/status/2056870168421171339 · Twitter Post
• https://mantisbt.org/bugs/view.php?id=36986 · Note