Which versions of MantisBT are affected by CVE-2026-40596?

MantisBT issue tracking systems running versions 2.28.1 and earlier contain a stored XSS vulnerability that allows authenticated users to inject malicious code affecting all system users, with…. A patch is available.

How to fix or mitigate CVE-2026-40596?

Within 24 hours, audit your deployment to identify all MantisBT instances running version 2.28.1 or earlier. Within 7 days, apply the vendor-released patch to upgrade all affected installations to the patched version as specified in the official security advisory. Within 30 days, review system audit logs for suspicious account preference modifications (particularly 'font_family' parameter changes) that may indicate exploitation attempts, and implement input validation controls on account preference functions to prevent future CSS injection attacks.

MantisBT CVE-2026-40596

Q: What is the CVSS score of CVE-2026-40596?

CVE-2026-40596 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 https://github.com/mantisbt/mantisbt

GHSA-j3v9-553h-x28j

XSS

7.2

CVSS 4.0 · Vendor: https://github.com/mantisbt/mantisbt

Severity by source

Vendor (https://github.com/mantisbt/mantisbt) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Authenticated user injects stored XSS (PR:L) that runs only when a victim loads the page (UI:R); cross-account compromise via chaining changes scope (S:C) with high confidentiality but limited integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (https://github.com/mantisbt/mantisbt).

CVSS VectorVendor: https://github.com/mantisbt/mantisbt

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:51 vuln.today

Analysis Generated

Jul 23, 2026 - 23:51 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

7.2 (HIGH)

CVE Published

May 11, 2026 - 19:34 nvd

HIGH

CVE Published

May 11, 2026 - 19:34 cve.org

HIGH 7.2

DescriptionCVE.org

Any authenticated user can inject arbitrary HTML via updating their account's font family.

Impact

Cross-site scripting. The injected payload will be reflected in every MantisBT page.

Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover.

Patches

9e8409cdd979eba86ef532756fc47c1d8112d22d

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

AnalysisAI

Stored cross-site scripting in MantisBT (Composer package mantisbt/mantisbt, versions <= 2.28.1) allows any authenticated user to inject arbitrary HTML/JavaScript through the 'font_family' account preference, which is then rendered into the CSS/head of every MantisBT page. Because the account preference update accepted an arbitrary font string without validating it against the allowed font list, the payload persists and executes whenever the affected page context is loaded. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is very low (0.05%), but chained with the companion CSP-bypass advisory GHSA-9c3j-xm6v-j7j3 the flaw can escalate to full account takeover.

Technical ContextAI

MantisBT is a widely used PHP-based open-source bug/issue tracker. The root cause is CWE-79 (improper neutralization of input during web page generation). In account_prefs_update.php the 'font_family' value taken from gpc_get_string() was written directly via config_set() into the per-user, ALL_PROJECTS configuration without checking membership in the allowed font enumeration; layout_head_css() and print_api.php then emitted that value into page markup. The fix introduces helper_get_font_list() and rejects any font not present in $g_font_family_choices / $g_font_family_choices_local (throwing ClientException), while additionally applying string_html_specialchars() output encoding in layout_api.php and print_api.php as defense in depth. The affected package is identified by CPE pkg:composer/mantisbt_mantisbt. The linked GHSA-9c3j-xm6v-j7j3 advisory documents a separate but composable weakness: the X-Content-Type-Options: nosniff / CSP script-src protection can be bypassed by uploading an attachment that PHP finfo sniffs as a valid JavaScript MIME type, letting an otherwise-blocked injected script actually execute.

RemediationAI

Vendor-released patch: upgrade to MantisBT 2.28.2, which contains the fixes (font_family validation commit 9e8409cdd979eba86ef532756fc47c1d8112d22d and the CSP-bypass fix commit 9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe). The advisory explicitly states no workarounds are available, so patching is the only supported remediation. If an immediate upgrade is not possible, compensating controls are limited: restrict who holds accounts (this requires an authenticated session to exploit), and because the chained escalation relies on the attachment CSP bypass you can raise the bar by tightening attachment upload/download handling (e.g., limit allowed attachment types or serve file_download.php content with hardened Content-Type/Content-Disposition) - note this may disrupt legitimate file sharing. Backporting the helper_get_font_list() allow-list check and the string_html_specialchars() output encoding is the closest thing to the actual fix. Refer to https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3 and the patch commit URLs above.