Which versions of MantisBT are affected by CVE-2026-44655?

MantisBT project management systems versions 1.3.0-2.28.1 contain a stored cross-site scripting vulnerability in the administrator Move Attachments page that could allow manager or administrator…. A patch is available.

How to fix or mitigate CVE-2026-44655?

Within 24 hours, identify all MantisBT instances running versions 1.3.0-2.28.1. Within 7 days, apply the vendor-released patch to all affected instances and verify the project name field no longer renders unescaped content in the Move Attachments admin page. Within 30 days, audit access controls for manager and administrator privileges and review logs for any unauthorized activity targeting the Move Attachments function.

MantisBT CVE-2026-44655

Q: What is the CVSS score of CVE-2026-44655?

CVE-2026-44655 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33025 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 https://github.com/mantisbt/mantisbt

GHSA-7mqj-8gj2-cg59

XSS

8.6

CVSS 4.0 · Vendor: https://github.com/mantisbt/mantisbt

Severity by source

Vendor (https://github.com/mantisbt/mantisbt) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Injecting the Project Name requires manager/admin rights (PR:H), the payload fires only when another admin views the page (UI:R), stored XSS crosses into the victim's browser context (S:C) with limited C/I and no availability impact, further blunted by CSP.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (https://github.com/mantisbt/mantisbt).

CVSS VectorVendor: https://github.com/mantisbt/mantisbt

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:44 vuln.today

Analysis Generated

Jul 23, 2026 - 23:44 vuln.today

CVSS changed

May 28, 2026 - 21:22 NVD

8.6 (HIGH)

CVE Published

May 11, 2026 - 19:40 cve.org

HIGH 8.6

CVE Published

May 11, 2026 - 19:40 nvd

HIGH

DescriptionCVE.org

Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page.

Impact

Cross-site scripting (XSS). This is mitigated by Content Security Policy which restricts scripts execution.

Patches

5cb4b469295889f5d2b01677c9bf82c143e0fdaa

Workarounds

None

AnalysisAI

Stored cross-site scripting in MantisBT (versions 1.3.0 through 2.28.1) lets a user with manager or administrator privileges inject HTML via an unescaped Project Name that renders on the Move Attachments admin page (admin/move_attachments_page.php). Because the payload only fires when another privileged user opens that admin page and script execution is further constrained by the application's Content Security Policy, real-world impact is limited; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).

Technical ContextAI

MantisBT is a widely used open-source, PHP-based web bug-tracking system distributed via Composer (pkg:composer/mantisbt_mantisbt). The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: the Project Name field is stored and later echoed into an HTML table cell without output encoding. The commit diff confirms the root cause and fix precisely - the vulnerable line echo '<td>' . $t_project['name'] . '</td>'; was changed to wrap the value in string_html_specialchars( $t_project['name'] ), neutralizing HTML metacharacters. This is a stored/persistent XSS because the injected Project Name persists in the database and is rendered whenever a privileged user loads the Move Attachments administrative page.

RemediationAI

Upgrade to MantisBT 2.28.2, which contains the fix (Vendor-released patch: 2.28.2), applied via commit 5cb4b469295889f5d2b01677c9bf82c143e0fdaa that HTML-escapes the Project Name on the Move Attachments page; see the advisory at https://github.com/mantisbt/mantisbt/security/advisories/GHSA-7mqj-8gj2-cg59. The vendor lists no workarounds. If immediate patching is not possible, the exploit surface is inherently gated behind manager/administrator accounts, so tightening who holds those roles and auditing existing Project Names for HTML/script content reduces exposure; ensure the deployed Content Security Policy remains enabled and restrictive since the vendor states CSP mitigates script execution, though CSP is a defense-in-depth control and does not fully eliminate HTML injection or clickjacking-style abuse. Avoid granting project-creation or project-rename capability to untrusted users until upgraded.