Cross-site scripting in MantisBT - CVE-2026-44655
Published: November 6, 2026
Vulnerability identifier: #VU159795
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-44655
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a manager or administrator to inject stored cross-site scripting content into the MantisBT Move Attachments admin page viewed by another administrator.
The vulnerability exists due to missing escaping of stored project names when they are displayed on the Move Attachments admin page. A manager or administrator with permission to set project names can store malicious HTML that is rendered when another administrator opens the page.
Affected software
MantisBT
How to mitigate CVE-2026-44655
Install security update from vendor's website.
MantisBT - update to 2.28.2