XSS in Mantisbt

CVE-2026-40607

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.11.0 through 2.28.1, a Stored XSS vulnerability is caused by incorrect escaping of a saved filter's owner, allowing an attacker to inject arbitrary HTML on system…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (17.1th percentile) — read the EPSS interpretation.

Affected products

  • Mantisbt — versions >= 2.1.0, < 2.28.2

Weakness classification (CWE)

References