CVE-2026-44655: MantisBT stored XSS in Move Attachments admin page

CVE-2026-44655 · Severity: high · CVSS 4 · Published 2026-05-28

MantisBT, a popular open-source bug tracking system, is vulnerable to a security flaw where malicious code can be embedded into project names. If an administrator or manager creates a project with a specially crafted name, they can execute unauthorized scripts when other administrators visit the 'Move Attachments' management page. This could lead to unauthorized access to sensitive data or administrative actions being performed without the user's knowledge.

Technologies: MantisBT, mantisbt/mantisbt (Packagist). Vendors: MantisBT, Packagist.

Quick answers

Is CVE-2026-44655 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44655 being exploited in the wild.
How severe is CVE-2026-44655?
High severity, with a CVSS score of 4, published 28 May 2026.
Which products and versions are affected?
MantisBT >= 1.3.0, <= 2.28.1, 1.3.0 to 2.28.1; mantisbt/mantisbt (Packagist) >= 1.3.0, <= 2.28.1, ECOSYSTEM:introduced=1.3.0,fixed=2.28.2.
Is there a fix for CVE-2026-44655?
Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44655 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44655?
Check whether you run MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later
    composer require mantisbt/mantisbt:^2.28.2

Technical details

A stored cross-site scripting (XSS) vulnerability exists in MantisBT versions 1.3.0 through 2.28.1. The vulnerability is located in the 'Move Attachments' admin page, where project names are rendered without proper HTML escaping. An attacker with sufficient privileges to create or rename projects (typically Manager or Administrator) can inject malicious HTML/JavaScript into the project name field. When an administrator subsequently views the Move Attachments page, the payload executes in their browser context. While the impact is mitigated by the application's Content Security Policy (CSP), the vulnerability is addressed in version 2.28.2.

Affected products

  • MantisBT MantisBT >= 1.3.0, <= 2.28.1

Identifiers

  • CVE-2026-44655
  • GHSA-7mqj-8gj2-cg59

Timeline

  • 2026-05-11: advisory: GitHub Advisory published
  • 2026-05-28: disclosed: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.