PT-2026-39881 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-23 · CVE-2026-40596

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions MantisBT (affected versions not specified)

Description An authenticated user can inject arbitrary HTML by updating the font family of their account. This leads to cross-site scripting, where the injected payload is reflected on every page of the application. If combined with a Content Security Policy (CSP) bypass—a security layer that prevents the loading of malicious scripts—this could lead to account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40596

GHSA-J3V9-553H-X28J

Affected Products

Mantisbt

References · 11

• https://osv.dev/vulnerability/GHSA-j3v9-553h-x28j · Vendor Advisory
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3 · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j3v9-553h-x28j · Note
• https://github.com/mantisbt/mantisbt/commit/9e8409cdd979eba86ef532756fc47c1d8112d22d · Note
• https://github.com/mantisbt/mantisbt · Note
• https://mantisbt.org/bugs/view.php?id=37016 · Note
• https://twitter.com/dailycve/status/2053992129194533181 · Twitter Post
• https://mantisbt.org/bugs/view.php?id=37011 · Note
• https://twitter.com/infoflowcloud/status/2058156289063051521 · Twitter Post
• https://t.me/CVEtracker/54666 · Telegram Post
• https://twitter.com/CVEnew/status/2058155788808732871 · Twitter Post