Detections
Analytics

SCA: security update for mantisbt/mantisbt (GHSA-qj6w-v29q-4rgx)

medium Tenable Cloud Security Plugin ID 441746

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and below contain flawed
 logic that causes improper escaping of a textarea custom field's contents in the Update Issue page,
 (bug_update_page.php) allowing an attacker to inject HTML and, if CSP settings permit, execute arbitrary
 JavaScript when the page is loaded. This facilitates session theft, leading to admin account takeover,
 full project data access. In order to exploit this issue, a textarea-type custom field must be configured
 for the project, the attack must be carried out by an authenticated user with bug report permission (low
 privilege). This can affect any user viewing the bug edit form, including administrators. The issue has
 been fixed in version 2.28.2. If users cannot immediately upgrade, they can work around the issue by using
 the default Content-Security Policy, which blocks script execution. (CVE-2026-39960)

Solution

Update the mantisbt/mantisbt library and its related packages to version 2.28.2 or later.

See Also

https://github.com/advisories/GHSA-qj6w-v29q-4rgx

Plugin Details

Severity: Medium

ID: 441746

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 5/12/2026

Updated: 6/1/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.39

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-39960

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/11/2026

Vulnerability Publication Date: 5/11/2026

Reference Information

CVE: CVE-2026-39960

cwe: CWE-79