CVE-2026-41897: MantisBT reflected XSS in return_dynamic_filters.php

Executive brief

MantisBT, a popular open-source bug tracking system, is vulnerable to a security flaw that allows attackers to inject malicious scripts into the application. By manipulating specific data fields used in the issue viewing page, an attacker could potentially steal user session information or perform unauthorized actions on behalf of other users. This issue affects organizations using MantisBT to manage software defects and project tasks.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in MantisBT due to a lack of validation of the 'filter_target' parameter in 'return_dynamic_filters.php'. This component is typically used via AJAX on the 'View Issues' page. If the target is a TEXTAREA custom field, an attacker can inject arbitrary HTML and JavaScript. Exploitation requires network access and low privileges (PR:L), allowing an attacker to execute scripts in the context of a user's session. The issue is fixed in version 2.28.2.

Affected products

• MantisBT MantisBT >= 1.0.0, < 2.28.2

Timeline

• 2026-05-11: advisory: GitHub Advisory published
• 2026-05-28: disclosed: NVD publication

References

• https://api.github.com/users/siunam321
• https://github.com/siunam321
• https://api.github.com/users/siunam321/gists%7B/gist_id%7D
• https://api.github.com/users/siunam321/repos
• https://avatars.githubusercontent.com/u/104430134?v=4
• https://api.github.com/users/siunam321/events%7B/privacy%7D