PatchSiren cyber security CVE debrief
CVE-2026-39960 mantisbt CVE debrief
CVE-2026-39960 affects Mantis Bug Tracker versions 2.28.1 and below. According to the CVE description published on 2026-05-20, flawed escaping in the Update Issue page (bug_update_page.php) can let an authenticated low-privilege user inject HTML, and potentially JavaScript if the site’s Content-Security Policy permits script execution. The issue can expose sessions and, in the worst case described, lead to administrator account takeover and full project data access. The issue is fixed in MantisBT 2.28.2; the default CSP is described as a workaround if immediate upgrade is not possible.
- Vendor
- mantisbt
- Product
- Unknown
- CVSS
- MEDIUM 5.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-20
- Original CVE updated
- 2026-05-21
- Advisory published
- 2026-05-20
- Advisory updated
- 2026-05-21
Who should care
MantisBT operators, especially administrators and project maintainers, should care if any project uses textarea-type custom fields and low-privilege users can create or update bug reports. Any user viewing the bug edit form may be exposed, including administrators.
Technical summary
The vulnerability is an XSS flaw (CWE-79) in the Update Issue page. The CVE and GitHub advisory describe improper escaping of textarea custom field contents in bug_update_page.php, which can result in HTML injection and, if CSP is permissive, JavaScript execution. Exploitation requires a configured textarea-type custom field and an authenticated attacker with bug report permission.
Defensive priority
Medium priority. The CVSS vector provided is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating reachable network attack conditions but requiring authentication and user interaction. Upgrade to the fixed release should be prioritized where MantisBT is exposed to regular users or administrators review bug edit forms.
Recommended defensive actions
- Upgrade MantisBT to version 2.28.2 or later.
- If upgrade is not immediate, keep the default Content-Security Policy enabled as described in the advisory.
- Review projects that use textarea-type custom fields in bug reporting or issue editing workflows.
- Limit bug report permissions to the minimum necessary set of authenticated users.
- Treat bug edit pages as sensitive and verify they do not render untrusted field content unsafely.
Evidence notes
This debrief is based only on the supplied CVE record and official GitHub references. The CVE record states the product, affected versions, impact, required conditions, and fixed version. The source metadata also lists CWE-79 and the CVSS vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No KEV entry was provided.
Official resources
Publicly disclosed on 2026-05-20 per the supplied CVE published date.