Is CVE-2026-40598 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40598 being exploited in the wild.

How severe is CVE-2026-40598?

Medium severity, with a CVSS score of 4, published 22 May 2026.

Which products and versions are affected?

MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.

Is there a fix for CVE-2026-40598?

Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40598 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-40598?

Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40598: MantisBT HTML injection in tag update page

Q: Which products and versions are affected?

MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.

Q: Is there a fix for CVE-2026-40598?

Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40598 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-40598?

Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40598 · Severity: medium · CVSS 4 · Published 2026-05-22

MantisBT is an open-source software tool used by organizations to track software bugs and project issues. A security flaw in the system's tag update page could allow an attacker to inject malicious code into the application. While difficult to exploit in standard setups, it could lead to unauthorized actions or data theft if the system is used behind certain web caching or proxy servers.

Technologies: MantisBT, mantisbt/mantisbt (Packagist). Vendors: MantisBT, Packagist.

Quick answers

Is CVE-2026-40598 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40598 being exploited in the wild.
How severe is CVE-2026-40598?: Medium severity, with a CVSS score of 4, published 22 May 2026.
Which products and versions are affected?: MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.
Is there a fix for CVE-2026-40598?: Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40598 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-40598?: Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later
```
composer require mantisbt/mantisbt:^2.28.2
```

Technical details

A reflected HTML injection vulnerability exists in MantisBT versions 2.28.1 and below within the 'tag_update_page.php' component. The application fails to properly escape the 'redirect' hidden input field, which is populated using the 'Referer' HTTP header. While modern browsers typically URL-encode the Referer header, preventing direct exploitation, an attacker could potentially achieve cross-site scripting (XSS) in environments utilizing server-side caching (like Varnish) or those susceptible to HTTP request smuggling. The vulnerability is exploited by sending a crafted Referer header containing HTML/JavaScript payloads. This issue is fixed in version 2.28.2 by implementing proper HTML special character escaping.

Affected products

MantisBT MantisBT <= 2.28.1

Identifiers

CVE-2026-40598
GHSA-6jh4-47v2-4g37

Timeline

2026-04-12: disclosed: Initial report by security researcher siunam
2026-05-09: patched: Fix released in version 2.28.2
2026-05-22: advisory: Public advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.