PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39960 mantisbt CVE debrief

CVE-2026-39960 affects Mantis Bug Tracker versions 2.28.1 and below. According to the CVE description published on 2026-05-20, flawed escaping in the Update Issue page (bug_update_page.php) can let an authenticated low-privilege user inject HTML, and potentially JavaScript if the site’s Content-Security Policy permits script execution. The issue can expose sessions and, in the worst case described, lead to administrator account takeover and full project data access. The issue is fixed in MantisBT 2.28.2; the default CSP is described as a workaround if immediate upgrade is not possible.

Vendor
mantisbt
Product
Unknown
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-23
Advisory published
2026-05-20
Advisory updated
2026-07-23

Who should care

MantisBT operators, especially administrators and project maintainers, should care if any project uses textarea-type custom fields and low-privilege users can create or update bug reports. Any user viewing the bug edit form may be exposed, including administrators.

Technical summary

The vulnerability is an XSS flaw (CWE-79) in the Update Issue page. The CVE and GitHub advisory describe improper escaping of textarea custom field contents in bug_update_page.php, which can result in HTML injection and, if CSP is permissive, JavaScript execution. Exploitation requires a configured textarea-type custom field and an authenticated attacker with bug report permission.

Defensive priority

Medium priority. The CVSS vector provided is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating reachable network attack conditions but requiring authentication and user interaction. Upgrade to the fixed release should be prioritized where MantisBT is exposed to regular users or administrators review bug edit forms.

Recommended defensive actions

  • Upgrade MantisBT to version 2.28.2 or later.
  • If upgrade is not immediate, keep the default Content-Security Policy enabled as described in the advisory.
  • Review projects that use textarea-type custom fields in bug reporting or issue editing workflows.
  • Limit bug report permissions to the minimum necessary set of authenticated users.
  • Treat bug edit pages as sensitive and verify they do not render untrusted field content unsafely.

Evidence notes

This debrief is based only on the supplied CVE record and official GitHub references. The CVE record states the product, affected versions, impact, required conditions, and fixed version. The source metadata also lists CWE-79 and the CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No KEV entry was provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39960 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39960

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39960 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39960

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.