CVE-2026-44655

EPSS 0.06%

MantisBT has Stored XSS on Move Attachments Admin Page

Published: 5/11/2026Modified: 5/11/2026

Description

Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page. ### Impact Cross-site scripting (XSS). This is mitigated by Content Security Policy which restricts scripts execution. ### Patches - 5cb4b469295889f5d2b01677c9bf82c143e0fdaa ### Workarounds None

Affected packages (1)

Packagist/mantisbt/mantisbt>= 1.3.0, < 2.28.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (4)

PATCHhttps://github.com/mantisbt/mantisbt
WEBhttps://github.com/mantisbt/mantisbt/commit/5cb4b469295889f5d2b01677c9bf82c143e0fdaa
WEBhttps://github.com/mantisbt/mantisbt/security/advisories/GHSA-7mqj-8gj2-cg59
WEBhttps://mantisbt.org/bugs/view.php?id=37099