CVE-2026-40596: MantisBT stored XSS in user font family preference

CVE-2026-40596 · Severity: high · CVSS 4 · Published 2026-05-22

MantisBT is an open-source software tool used by organizations to track software bugs and project issues. A security flaw allows any logged-in user to inject malicious code into the system by changing their account's font settings. If combined with other known weaknesses, this could allow an attacker to take over other user accounts, potentially compromising sensitive project data and internal operations.

Technologies: MantisBT, mantisbt/mantisbt (Packagist). Vendors: MantisBT, Packagist.

Quick answers

Is CVE-2026-40596 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40596 being exploited in the wild.
How severe is CVE-2026-40596?
High severity, with a CVSS score of 4, published 22 May 2026.
Which products and versions are affected?
MantisBT >= 2.11.0, <= 2.28.1, 2.11.0 through 2.28.1; mantisbt/mantisbt (Packagist) >= 2.11.0, <= 2.28.1, ECOSYSTEM:introduced=2.11.0,fixed=2.28.2.
Is there a fix for CVE-2026-40596?
Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40596 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-40596?
Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later
    composer require mantisbt/mantisbt:^2.28.2

Technical details

A stored cross-site scripting (XSS) vulnerability exists in MantisBT due to improper neutralization of input in the user profile's font family preference field. An authenticated attacker can inject an XSS payload that is subsequently reflected on every page of the application. While MantisBT employs a Content Security Policy (CSP), this vulnerability can be chained with a separate CSP bypass (such as GHSA-9c3j-xm6v-j7j3) to execute arbitrary JavaScript. Successful exploitation can lead to session hijacking and full account takeover. The issue is resolved in version 2.28.2.

Affected products

  • MantisBT MantisBT 2.11.0 through 2.28.1

Identifiers

  • CVE-2026-40596
  • GHSA-j3v9-553h-x28j

Timeline

  • 2026-05-09: advisory: Vendor advisory published via GitHub
  • 2026-05-22: disclosed: CVE-2026-40596 published
  • 2026-05-22: patched: Fixed in version 2.28.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.