Vulnerability Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploitation, an XSS payload would be reflected on every MantisBT page. Leveraging another vulnerability (CSP bypass, see GHSA-9c3j-xm6v-j7j3), the attacker could achieve account takeover. This issue has been fixed in version 2.28.2.
Related Weaknesses (CWE)
References
- https://github.com/mantisbt/mantisbt/commit/9e8409cdd979eba86ef532756fc47c1d8112
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j3v9-553h-x28j
- https://mantisbt.org/bugs/view.php?id=37011
- https://mantisbt.org/bugs/view.php?id=37016
FAQ
What is CVE-2026-40596?
CVE-2026-40596 is a documented vulnerability. Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.11.0 through 2.28.1 allow any authenticated user to inject arbitrary HTML by updating their account's font family. Upon exploi...
How severe is CVE-2026-40596?
CVSS scoring is not yet available for CVE-2026-40596. Check NVD for updates.
Is there a patch for CVE-2026-40596?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.