medium5.3
CVE-2026-41897
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
Impact
Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. This vulnerability is fixed in 2.28.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mantisbt/mantisbt | >= 1.0.0, < 2.28.2 | 2.28.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-j7v9-f46r-2rp4
- https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j7v9-f46r-2rp4
- https://github.com/mantisbt/mantisbt/commit/c885af13f0b8596714ffe11df757c09f35fbd8f4
- https://mantisbt.org/bugs/view.php?id=37013
- https://nvd.nist.gov/vuln/detail/CVE-2026-41897