MantisBT CVE-2026-40598
MEDIUM
GHSA-6jh4-47v2-4g37
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the need for a caching intermediary; UI:R required for victim to receive and trigger the poisoned cached response; S:C for browser context escape enabling XSS.
Primary rating from Vendor (https://github.com/mantisbt/mantisbt).
CVSS VectorVendor: https://github.com/mantisbt/mantisbt
Lifecycle Timeline
4DescriptionCVE.org
Improper escaping of the redirection page (retrieved from the request's *Referer* header) allows an attacker to inject HTML.
While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting.
Impact
Cross-site scripting (XSS).
Patches
- b1ebc57763f104eb5f541b7b4d1ce6948168abd9
Workarounds
None
Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
AnalysisAI
Reflected HTML injection in MantisBT's tag update page (tag_update_page.php) arises from the application echoing the HTTP Referer header into an HTML hidden input without proper escaping. All versions through 2.28.1 are affected. In the most exploitable scenario, an attacker poisons a caching proxy by submitting a crafted Referer value, causing downstream users who receive the cached response to execute attacker-controlled JavaScript - a web-cache-deception-style XSS path. No public exploit identified at time of analysis, though SSVC classifies exploitation status as poc; EPSS is low at 0.04% (14th percentile).
Technical ContextAI
MantisBT (composer/mantisbt/mantisbt, CPE pkg:composer/mantisbt_mantisbt) is an open-source PHP bug-tracking application. The flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) exists in tag_update_page.php, where the variable $t_redirect_page - populated from the browser's Referer header - was previously written directly into an HTML attribute value: <input type='hidden' name='redirect' value='<?php echo $t_redirect_page ?>'/>. Without calling string_html_specialchars() to HTML-encode the value, any special characters included in the Referer bypass the attribute context boundary. The commit b1ebc57763f104eb5f541b7b4d1ce6948168abd9 applies the missing escaping function. Modern browsers generally URL-encode special characters in the Referer, narrowing the direct reflected-XSS surface; however, reverse proxies or CDN configurations that cache responses containing raw Referer values create a persistent XSS vector.
RemediationAI
Upgrade MantisBT to version 2.28.2, which applies proper HTML escaping to the Referer-derived redirect value via string_html_specialchars() in tag_update_page.php (patch commit b1ebc57763f104eb5f541b7b4d1ce6948168abd9, advisory https://github.com/mantisbt/mantisbt/security/advisories/GHSA-6jh4-47v2-4g37). No official workaround is provided by the vendor. As a compensating control for environments that cannot immediately patch, stripping or nullifying the Referer header at the reverse proxy or WAF layer before it reaches MantisBT would eliminate the injection surface - note this may break legitimate redirect flows within the application. Disabling caching for responses from tag_update_page.php at any intermediary (CDN, Varnish, nginx proxy_cache) removes the cache-poisoning escalation path without disrupting functionality, and should be applied even after patching as defense in depth.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today