PT-2026-39884 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-40607

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MantisBT (affected versions not specified)

Description Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where the $g show user realname variable is set to ON, leading to Cross-site scripting (XSS). By default, only users with Manager access level or above can save filters publicly.

Recommendations Set $g show user realname = OFF in the configuration to prevent the display of users' real names. Restrict the ability to store filters by setting $g stored query create threshold and $g stored query create shared threshold to NOBODY.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-40607

GHSA-F633-865Q-2MHH

Affected Products

Mantisbt

References · 6

• https://osv.dev/vulnerability/GHSA-f633-865q-2mhh · Vendor Advisory
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-f633-865q-2mhh · Note
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/44f490bcf20fd491c1b8f3fc9dd041d8c2a30010 · Note
• https://mantisbt.org/bugs/view.php?id=37015 · Note
• https://twitter.com/dailycve/status/2053984350526390341 · Twitter Post