Junglewise Threat Intelligence

CVE-2026-40596: MantisBT stored XSS in user font family preference

CVE-2026-40596 · Severity: high · CVSS 4 · Published 2026-05-22

Technologies: mantisbt/mantisbt (Packagist), MantisBT. Vendors: Packagist, MantisBT.

Executive brief

MantisBT is an open-source software tool used by organizations to track software bugs and project issues. A security flaw allows any logged-in user to inject malicious code into the system by changing their account's font settings. If combined with other known weaknesses, this could allow an attacker to take over other user accounts, potentially compromising sensitive project data and internal operations.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in MantisBT due to improper neutralization of input in the user profile's font family preference field. An authenticated attacker can inject an XSS payload that is subsequently reflected on every page of the application. While MantisBT employs a Content Security Policy (CSP), this vulnerability can be chained with a separate CSP bypass (such as GHSA-9c3j-xm6v-j7j3) to execute arbitrary JavaScript. Successful exploitation can lead to session hijacking and full account takeover. The issue is resolved in version 2.28.2.

Affected products

  • MantisBT MantisBT 2.11.0 through 2.28.1

Timeline

  • 2026-05-09: advisory: Vendor advisory published via GitHub
  • 2026-05-22: disclosed: CVE-2026-40596 published
  • 2026-05-22: patched: Fixed in version 2.28.2

References

Related threats