~ / search / GHSA-7mqj-8gj2-cg59

GHSA-7mqj-8gj2-cg59

MantisBT has Stored XSS on Move Attachments Admin Page

Source: GitHub Advisory Database (reviewed) High CVE-2026-44655

Packages

EcosystemPackageAffectedFixed in
Packagist mantisbt/mantisbt >= 1.3.0, < 2.28.2 2.28.2

Details

As written in the advisory (Markdown source, shown as plain text).

Unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page. ### Impact Cross-site scripting (XSS). This is mitigated by Content Security Policy which restricts scripts execution. ### Patches - 5cb4b469295889f5d2b01677c9bf82c143e0fdaa ### Workarounds None

References

External links from the advisory. They lead to third-party sites.