mantisbt Mantis Bug Tracker up to 2.28.1 Update Issue Page bug_update_page.php cross site scripting

Summaryinfo

A vulnerability was found in mantisbt Mantis Bug Tracker up to 2.28.1 and classified as problematic. Affected by this issue is some unknown functionality of the file bug_update_page.php of the component Update Issue Page. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-39960. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in mantisbt Mantis Bug Tracker up to 2.28.1. Affected by this issue is an unknown code of the file bug_update_page.php of the component Update Issue Page. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custom field's contents in the Update Issue page, (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover, full project data access. In order to exploit this issue, a textarea-type custom field must be configured for the project, the attack must be carried out by an authenticated user with bug report permission (low privilege). This can affect any user viewing the bug edit form, including administrators. The issue has been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using the default Content-Security Policy, which blocks script execution.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-39960 since 04/08/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

By approaching the search of inurl:bug_update_page.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.28.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31192). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Bug Tracking Software

Vendor

• mantisbt

Name

• Mantis Bug Tracker

Version

• 2.28.0
• 2.28.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion