CVE-2026-40598
MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.
INFO
Published Date :
May 22, 2026, 7:32 p.m.
Last Modified :
May 22, 2026, 7:32 p.m.
Remotely Exploit :
No
Source :
GitHub_M
Solution
- Update MantisBT to version 2.28.2 or later.
- Verify secure handling of Referer header.
- Implement input validation for all user inputs.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-40598 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-40598 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
May. 22, 2026
Action Type Old Value New Value Added Description Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-79 Added Reference https://github.com/mantisbt/mantisbt/commit/b1ebc57763f104eb5f541b7b4d1ce6948168abd9 Added Reference https://github.com/mantisbt/mantisbt/security/advisories/GHSA-6jh4-47v2-4g37 Added Reference https://mantisbt.org/bugs/view.php?id=37017