PT-2026-39883 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-40598

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MantisBT (affected versions not specified)

Description Improper escaping of the redirection page, which is retrieved from the Referer header of the request, allows an attacker to inject HTML. In certain server configurations, this can lead to cache poisoning, resulting in cross-site scripting (XSS), a technique where malicious scripts are injected into otherwise trusted websites.

Recommendations Apply the patch b1ebc57763f104eb5f541b7b4d1ce6948168abd9.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40598

GHSA-6JH4-47V2-4G37

Affected Products

Mantisbt

References · 6

• https://osv.dev/vulnerability/GHSA-6jh4-47v2-4g37 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-6jh4-47v2-4g37 · Note
• https://github.com/mantisbt/mantisbt/commit/b1ebc57763f104eb5f541b7b4d1ce6948168abd9 · Note
• https://mantisbt.org/bugs/view.php?id=37017 · Note
• https://twitter.com/dailycve/status/2053991700155007243 · Twitter Post