Cross-site scripting in MantisBT - CVE-2026-39960
Published: November 6, 2026
Vulnerability identifier: #VU159802
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-39960
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user with bug report permission to execute arbitrary JavaScript in another user's browser.
The vulnerability exists due to improper escaping of textarea custom field values when MantisBT renders the Update Issue page for a project configured with such a field. An authenticated user with bug report permission can store a malicious value that steals an administrator's session when the administrator opens the issue edit form, provided Content-Security Policy settings permit script execution.
Affected software
MantisBT
How to mitigate CVE-2026-39960
Install security update from vendor's website.
MantisBT - update to 2.28.2