CVE-2026-40607 mantisbt CVE debrief

Who should care

Users of Mantis Bug Tracker (MantisBT) versions 2.11.0 through 2.28.1 should be aware of this Stored XSS vulnerability and take steps to mitigate it. This includes updating to version 2.28.2 or applying workarounds such as preventing display of users' real names and restricting the ability to store filters. Operators, platform administrators, vulnerability management teams, and security teams should review the affected scope and severity to determine the necessary actions.

Technical summary

The vulnerability is caused by incorrect escaping of a saved filter's owner in Mantis Bug Tracker (MantisBT) versions 2.11.0 through 2.28.1, allowing an attacker to inject arbitrary HTML on systems where $g_show_user_realname = ON. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. The CVE record was published on 2026-05-22T20:16:34.627Z and last modified on 2026-07-23T11:10:00.120Z. This issue has been fixed in version 2.28.2. By default, only users with Manager access level or above can save their filters publicly.

Defensive priority

High

Recommended defensive actions

• Update Mantis Bug Tracker (MantisBT) to version 2.28.2 or later
• Prevent display of users' real names by setting $g_show_user_realname = OFF
• Restrict the ability to store filters by setting $g_stored_query_create_threshold / $g_stored_query_create_shared_threshold to NOBODY
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide evidence of the vulnerability and its impact. The vulnerability is caused by incorrect escaping of a saved filter's owner, allowing an attacker to inject arbitrary HTML. The CVE record and NVD entry also provide information on the affected versions and the fixed version. However, the source detail is limited, and defenders should verify the affected scope and severity with the vendor or other reliable sources.

Official resources