CVE-2026-40598 MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page
Attackers can inject HTML via the Referer header in MantisBT, potentially leading to cross-site scripting under specific server configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40598?
CVE-2026-40598 is a medium-severity cross-site scripting vulnerability in mantisbt, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.
Weakness: CWE-79
Which versions are affected by CVE-2026-40598?
2 open source packages ship an affected version, including mantisbt/mantisbt.
| Package | Affected | Fixed in |
|---|---|---|
mantisbt/mantisbt Packagist | All versions | 2.28.2 |
mantisbt/mantisbt Packagist | All versions | 2.28.2 |
How do I fix CVE-2026-40598?
Upgrade mantisbt/mantisbt to 2.28.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-40598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40598 exists.
Sources
Also known as GHSA-6jh4-47v2-4g37.