PT-2026-39899 · Packagist · Mantisbt/Mantisbt

Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-44655

OSV

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page.

Impact

Cross-site scripting (XSS). This is mitigated by Content Security Policy which restricts scripts execution.

Patches

• 5cb4b469295889f5d2b01677c9bf82c143e0fdaa

Workarounds

None

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-44655

GHSA-7MQJ-8GJ2-CG59

Affected Products

Mantisbt/Mantisbt

References · 5

• https://osv.dev/vulnerability/GHSA-7mqj-8gj2-cg59 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/5cb4b469295889f5d2b01677c9bf82c143e0fdaa · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-7mqj-8gj2-cg59 · Note
• https://mantisbt.org/bugs/view.php?id=37099 · Note