CVE-2026-40596: MantisBT XSS Vulnerability

CVE-2026-40596 Overview

CVE-2026-40596 is a stored Cross-Site Scripting (XSS) vulnerability in Mantis Bug Tracker (MantisBT), an open source issue tracking platform. The flaw exists in versions 2.11.0 through 2.28.1 and allows any authenticated user to inject arbitrary HTML by updating the font family setting on their account profile. The injected payload reflects on every MantisBT page rendered for any user who encounters the attacker-controlled content. When chained with the Content Security Policy (CSP) bypass tracked in GHSA-9c3j-xm6v-j7j3, attackers can escalate to full account takeover. The issue is categorized under [CWE-79] and has been resolved in MantisBT version 2.28.2.

Critical Impact
Authenticated attackers can inject persistent HTML/JavaScript executed in other users' browser sessions, enabling session theft and account takeover when combined with the related CSP bypass.

Affected Products

MantisBT versions 2.11.0 through 2.28.1
MantisBT instances allowing self-service account customization
Multi-tenant MantisBT deployments where untrusted users hold accounts

Discovery Timeline

2026-05-22 - CVE-2026-40596 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-40596

Vulnerability Analysis

The vulnerability resides in the user account preferences component, specifically the field controlling the rendered font family. MantisBT writes the user-supplied value into HTML output without enforcing strict sanitization on the font family string. Because the value is rendered inline in style attributes or style blocks on every page load, an attacker can break out of the expected CSS context and inject arbitrary HTML. The payload persists across sessions and triggers whenever the affected stylesheet is loaded.

The stored nature of the bug increases its severity. Any authenticated user, including low-privilege reporters, can write a payload that targets administrators or project managers. On its own, the issue allows HTML injection. Combined with the companion CSP bypass disclosed in GHSA-9c3j-xm6v-j7j3, JavaScript execution becomes viable, leading to session token theft and account takeover.

Root Cause

The root cause is missing output encoding on the user-controlled font family preference. MantisBT trusted the value as a CSS token and embedded it directly into rendered pages without validating that it conformed to permitted CSS identifiers or quoted strings. This violates the principle of treating all user input as untrusted, leading to the [CWE-79] classification.

Attack Vector

Exploitation requires only authenticated access (PR:L) and a single update to the victim's own account preferences. The attacker submits a malicious font family value containing HTML breakout characters. Subsequent page loads render the injected markup. Victim interaction (UI:P) is needed to load a page that includes the attacker-controlled stylesheet context. The fix is implemented in commit 9e8409cdd979eba86ef532756fc47c1d8112d22d.

No verified public exploit code is available. Technical details are tracked in MantisBT Bug Report #37011 and Bug Report #37016.

Detection Methods for CVE-2026-40596

Indicators of Compromise

User profile records containing HTML tags, angle brackets, or javascript: schemes in the font family preference column.
Outbound HTTP requests from MantisBT user browsers to unfamiliar domains immediately after loading a profile or issue page.
Unexpected administrator session activity originating from IP addresses associated with low-privilege accounts.

Detection Strategies

Audit the MantisBT database mantis_user_pref_table for non-standard characters in the font family fields and flag any value not matching a strict CSS identifier allowlist.
Review web server access logs for account_prefs_update.php requests containing encoded <, >, or quote characters in the font parameters.
Inspect rendered HTML output from authenticated test sessions for unsanitized user-supplied content inside style attributes or blocks.

Monitoring Recommendations

Enable application-level logging of all account preference updates with before-and-after values for forensic review.
Monitor for anomalous DOM-level events such as unexpected cookie reads or XMLHttpRequest calls originating from MantisBT pages.
Alert on CSP violation reports if a report-only or enforcing policy is configured against the MantisBT origin.

How to Mitigate CVE-2026-40596

Immediate Actions Required

Upgrade all MantisBT instances to version 2.28.2 or later, which contains the upstream fix.
Audit existing user preferences for malicious font family entries and reset any values that fail strict validation.
Force a session reset for all users following the upgrade to invalidate any tokens that may have been stolen via prior exploitation.

Patch Information

The vulnerability is fixed in MantisBT 2.28.2. The corrective code change is published in commit 9e8409cdd979eba86ef532756fc47c1d8112d22d and described in GitHub Security Advisory GHSA-j3v9-553h-x28j. Operators should also review and apply the companion fix referenced in GHSA-9c3j-xm6v-j7j3 to close the CSP bypass exploit chain.

Workarounds

Restrict the ability to modify account preferences to trusted users until the patch is applied.
Enforce a strict Content Security Policy that disallows inline styles and inline scripts on MantisBT pages.
Place MantisBT behind a web application firewall rule that blocks profile update requests containing HTML metacharacters in the font family field.

bash

# Configuration example: upgrade MantisBT to the fixed release
cd /var/www/mantisbt
php admin/check.php
# Back up database and files, then deploy 2.28.2
wget https://downloads.sourceforge.net/mantisbt/mantisbt-2.28.2.tar.gz
tar -xzf mantisbt-2.28.2.tar.gz
# Replace existing installation files and run the upgrade script
php admin/install.php