Which versions of MantisBT are affected by CVE-2026-40607?

MantisBT versions 2.1.0 through 2.28.1 contain a stored cross-site scripting vulnerability affecting deployments with user realname display enabled, though no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-40607?

Within 24 hours, inventory all MantisBT installations running versions 2.1.0 through 2.28.1 to identify those with the $g_show_user_realname setting enabled. Within 7 days, apply the available vendor patch and validate in a non-production environment before production deployment. Within 30 days, verify all affected instances are patched, audit saved filters for suspicious content, and ensure the $g_show_user_realname setting is configured appropriately.

MantisBT CVE-2026-40607

Q: What is the CVSS score of CVE-2026-40607?

CVE-2026-40607 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 https://github.com/mantisbt/mantisbt

GHSA-f633-865q-2mhh

XSS

7.5

CVSS 4.0 · Vendor: https://github.com/mantisbt/mantisbt

Severity by source

Vendor (https://github.com/mantisbt/mantisbt) PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

AC:H for the non-default realname configuration requirement, PR:H because only Manager+ can save shared filters, S:C and C:L/I:L for browser-scoped stored XSS impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/mantisbt/mantisbt).

CVSS VectorVendor: https://github.com/mantisbt/mantisbt

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:50 vuln.today

Analysis Generated

Jul 23, 2026 - 23:50 vuln.today

CVSS changed

Jul 23, 2026 - 11:22 NVD

7.5 (HIGH)

CVE Published

May 11, 2026 - 19:35 cve.org

HIGH 7.5

CVE Published

May 11, 2026 - 19:35 nvd

HIGH

DescriptionCVE.org

Incorrect escaping of a saved filter's owner allows an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON.

Impact

Cross-site scripting (XSS).

Note that By default, only users with *Manager* access level or above can save their filters publicly

Patches

44f490bcf20fd491c1b8f3fc9dd041d8c2a30010

Workarounds

Prevent display of users' real name (set $g_ show_user_realname = OFF; in configuration)
Restrict ability to store filters (set $g_stored_query_create_threshold / $g_stored_query_create_shared_threshold to NOBODY

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

AnalysisAI

Stored cross-site scripting in MantisBT (versions 2.1.0 through 2.28.1) allows a privileged user to inject arbitrary HTML/JavaScript via their account's real name, which is rendered unescaped in the saved-filter owner column of the Manage Filters page. Exploitation is limited to deployments where $g_show_user_realname is enabled and requires an account permitted to save shared filters (Manager access or above by default), so it is not a drive-by unauthenticated flaw. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and it is not listed in CISA KEV.

Technical ContextAI

MantisBT is a widely used PHP-based open-source bug/issue tracking system (package pkg:composer/mantisbt_mantisbt). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). In manage_filter_page.php, the table_print_filter_row() function emitted the filter owner via user_get_name() directly into an HTML <td> without output encoding. When $g_show_user_realname = ON, user_get_name() returns the user's configured real name rather than a constrained username, so an attacker-controlled real-name string containing HTML is reflected verbatim into the DOM and executed in the browser of anyone viewing the shared saved filters list. The fix wraps the value in string_html_specialchars() to HTML-encode the output.

RemediationAI

Vendor-released patch: upgrade to MantisBT 2.28.2, which applies commit 44f490bcf20fd491c1b8f3fc9dd041d8c2a30010 to HTML-encode the filter owner via string_html_specialchars() (https://github.com/mantisbt/mantisbt/commit/44f490bcf20fd491c1b8f3fc9dd041d8c2a30010). If you cannot upgrade immediately, the vendor documents two workarounds: set $g_show_user_realname = OFF in config_inc.php so usernames (not attacker-controllable real names) are displayed, which eliminates the injection vector at the cost of losing real-name display; or set $g_stored_query_create_threshold and $g_stored_query_create_shared_threshold to NOBODY to prevent users from storing filters, which stops the payload from being saved but disables the saved/shared-filter feature for all users. Refer to advisory GHSA-f633-865q-2mhh for full guidance.