Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed logic that causes improper escaping of a textarea custom field's contents in the Update Issue page, (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover, full project data access. In order to exploit this issue, a textarea-type custom field must be configured for the project, the attack must be carried out by an authenticated user with bug report permission (low privilege). This can affect any user viewing the bug edit form, including administrators. The issue has been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using the default Content-Security Policy, which blocks script execution.

The version of MantisBT installed on the remote host is prior to 2.28.2. It is, therefore, affected by multiple vulnerabilities:

  - MantisBT is vulnerable to Privilege Escalation from Manager to Administrator. (CVE-2026-34390)

  - MantisBT is vulnerable to Authorization Bypass in Bugnote Editing via Issue Update API. (CVE-2026-42070)

  - MantisBT is vulnerable to Stored XSS in Custom Field Textarea Values. (CVE-2026-39960)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed
    logic that causes improper escaping of a textarea custom field's contents in the Update Issue page,
    (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary
    JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover,
    full project data access. In order to exploit this issue, a textarea-type custom field must be configured
    for the project, the attack must be carried out by an authenticated user with bug report permission (low
    privilege). This can affect any user viewing the bug edit form, including administrators. The issue has
    been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using
    the default Content-Security Policy, which blocks script execution. (CVE-2026-39960)

ID	Name	Product	Family	Type	Severity
315202	MantisBT < 2.28.2 Multiple Vulnerabilities	Nessus	CGI abuses : XSS	Remote	high
441746	SCA: security update for mantisbt/mantisbt (GHSA-qj6w-v29q-4rgx)	Tenable Cloud Security	SCA Checks	Local	medium
441746	SCA: security update for mantisbt/mantisbt (GHSA-qj6w-v29q-4rgx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-39960

medium

Tenable Plugins

high

medium

medium