PT-2026-39889 · Mantisbt · Mantisbt

Published 2026-05-11 · Updated 2026-05-28 · CVE-2026-41897

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MantisBT (affected versions not specified)

Description Lack of validation of the filter target parameter in the 'return dynamic filters.php' endpoint allows an attacker to inject arbitrary HTML when the target is a TEXTAREA custom field, leading to reflected Cross-site scripting (XSS), which is a technique where malicious scripts are injected into otherwise trusted websites.

Recommendations Apply patch c885af13f0b8596714ffe11df757c09f35fbd8f4. Avoid using the filter target parameter in the 'return dynamic filters.php' endpoint until the patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41897

GHSA-J7V9-F46R-2RP4

Affected Products

Mantisbt

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-41897 · Security Note
• https://osv.dev/vulnerability/GHSA-j7v9-f46r-2rp4 · Vendor Advisory
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j7v9-f46r-2rp4 · Note
• https://github.com/mantisbt/mantisbt/commit/c885af13f0b8596714ffe11df757c09f35fbd8f4 · Note
• https://github.com/mantisbt/mantisbt · Note
• https://twitter.com/dailycve/status/2053985241706946926 · Twitter Post
• https://mantisbt.org/bugs/view.php?id=37013 · Note