PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41897 mantisbt CVE debrief

Mantis Bug Tracker (MantisBT) versions 1.0.0 through 2.28.1 contain a stored cross-site scripting (XSS) vulnerability in the `return_dynamic_filters.php` endpoint. The `filter_target` parameter lacks proper validation, allowing an attacker with authenticated access to inject arbitrary HTML when the target is a TEXTAREA custom field. This endpoint is typically invoked via AJAX from the View Issues Page. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS 4.0 score of 5.3 (Medium severity). The issue was resolved in version 2.28.2.

Vendor
mantisbt
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running MantisBT instances with custom TEXTAREA fields and multi-user access environments. Security teams responsible for application security in bug tracking and issue management platforms.

Technical summary

The vulnerability exists in `return_dynamic_filters.php`, an AJAX endpoint used by the View Issues Page. The `filter_target` parameter accepts user-supplied input without adequate sanitization. When this parameter references a TEXTAREA custom field, unvalidated HTML can be injected and subsequently rendered in the browser context of other users. This constitutes a stored XSS condition requiring authenticated access to exploit. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N reflects network attack vector, low attack complexity, low privileges required, and low impacts to confidentiality and integrity with no availability impact.

Defensive priority

medium

Recommended defensive actions

  • Upgrade MantisBT to version 2.28.2 or later to remediate this vulnerability.
  • Review and validate all custom TEXTAREA fields for unexpected HTML content if running affected versions.
  • Implement Content Security Policy (CSP) headers to mitigate impact of any residual XSS vectors.
  • Audit access logs for requests to return_dynamic_filters.php with unusual filter_target parameters prior to patching.

Evidence notes

Vulnerability affects MantisBT 1.0.0 to 2.28.1. Fix commit c885af13f0b8596714ffe11df757c09f35fbd8f4 addresses the validation gap. Official GitHub Security Advisory GHSA-j7v9-f46r-2rp4 and MantisBT bug tracker issue 37013 confirm technical details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41897 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41897

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41897 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41897

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.