CVE-2026-40607: MantisBT Stored XSS Vulnerability

CVE-2026-40607 Overview

CVE-2026-40607 is a stored Cross-Site Scripting (XSS) vulnerability in Mantis Bug Tracker (MantisBT), an open source issue tracker. The flaw affects versions 2.11.0 through 2.28.1 and stems from incorrect escaping of a saved filter's owner field. An attacker can inject arbitrary HTML on systems where the configuration option $g_show_user_realname = ON. By default, only users with Manager access level or above can save filters publicly, which limits the attack surface. The issue is fixed in version 2.28.2. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers with Manager-level access can store malicious HTML and JavaScript that executes in the browsers of other MantisBT users viewing shared filters.

Affected Products

MantisBT versions 2.11.0 through 2.28.1
Installations with $g_show_user_realname = ON configured
Deployments allowing users with Manager access or above to save shared filters

Discovery Timeline

2026-05-22 - CVE-2026-40607 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-40607

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the MantisBT saved filter functionality. When a user saves a filter and $g_show_user_realname is enabled, the application renders the filter owner's real name without proper HTML escaping. An attacker who controls a user account with a crafted real name can inject HTML and JavaScript that executes when other users view the shared filter.

The attack requires high privileges because, by default, only Manager-level users or above can save filters publicly via the $g_stored_query_create_shared_threshold setting. The injected payload persists server-side and triggers on every render, affecting any user who loads the affected filter list. Exploitation can lead to session theft, forced actions on behalf of victims, or further compromise of the issue tracker.

Root Cause

The root cause is missing or incorrect output encoding of the saved filter owner field. The MantisBT codebase did not apply HTML escaping to the user's real name when it was rendered alongside saved filter metadata. The fix in commit 44f490b introduces proper escaping for this field.

Attack Vector

The attack vector is network-based and authenticated. An attacker first obtains an account with sufficient privileges to save a shared filter and to set a real name containing HTML or JavaScript. The attacker then saves a filter, which stores the malicious owner display string in the database. When another authenticated user lists or interacts with the saved filters, the unescaped real name is rendered into the page DOM and the injected script executes in the victim's browser context.

For full technical details, see the GitHub Security Advisory GHSA-f633-865q-2mhh and the MantisBT Bug Report #37015.

Detection Methods for CVE-2026-40607

Indicators of Compromise

User accounts with real name fields containing HTML tags such as <script>, <img>, or <svg> and JavaScript event handlers like onerror= or onload=.
Saved filter records in the MantisBT database whose owner display value contains angle brackets or encoded script payloads.
Unexpected outbound requests from analyst browsers to attacker-controlled domains after viewing saved filter pages.

Detection Strategies

Query the MantisBT mantis_user_table for realname values containing characters such as <, >, or javascript: substrings.
Inspect the mantis_filters_table for entries created by accounts with suspicious real names, especially shared filters created by Manager-level users.
Review web server access logs for filter-related URLs followed by anomalous client behavior or referrer chains indicating script-driven activity.

Monitoring Recommendations

Enable a Content Security Policy (CSP) on the MantisBT host and monitor CSP violation reports for inline script execution attempts.
Alert on new or modified shared saved filters, especially when the owner account was recently created or had its real name updated.
Audit privilege changes that promote users to Manager access or above, since this is the threshold required to exploit the flaw under default configuration.

How to Mitigate CVE-2026-40607

Immediate Actions Required

Upgrade MantisBT to version 2.28.2 or later, which contains the official fix from commit 44f490b.
Audit existing user accounts and remove or sanitize any realname values containing HTML or script content.
Review all stored shared filters and delete those created by untrusted or recently elevated accounts.

Patch Information

The MantisBT project addressed CVE-2026-40607 in version 2.28.2. The patch escapes the saved filter owner field before rendering. Administrators should apply the upstream release and validate that the deployed version is 2.28.2 or newer. Reference materials include the GitHub Security Advisory GHSA-f633-865q-2mhh and the upstream commit.

Workarounds

Disable display of user real names by setting $g_show_user_realname = OFF in the MantisBT configuration file.
Restrict the ability to create stored filters by setting $g_stored_query_create_threshold = NOBODY in the configuration.
Restrict the ability to create shared stored filters by setting $g_stored_query_create_shared_threshold = NOBODY.
Enforce a strict Content Security Policy that blocks inline scripts to reduce the impact of any residual stored XSS payloads.

bash

# Configuration example - config_inc.php workaround settings
$g_show_user_realname = OFF;
$g_stored_query_create_threshold = NOBODY;
$g_stored_query_create_shared_threshold = NOBODY;