High severityGHSA Advisory· Published May 19, 2026· Updated May 20, 2026

CVE-2026-34463

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before the category selector without proper escaping, allowing an attacker able to to inject HTML if they can set the Project's name (which typically requires manager or administrator access level). This issue has been resolved in version 2.28.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mantisbt/mantisbtPackagist	< 2.28.2	2.28.2

Affected products

Mantisbt/MantisbtGHSA
Range: <= 2.28.1
ghsa-coords
pkg:composer/mantisbt/mantisbt
Range: < 2.28.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fvjf-68wh-rwp2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-34463ghsaADVISORY
github.com/mantisbt/mantisbt/commit/df22697ae497ddd93f3d9132fdf4979db8d081cdnvdWEB
github.com/mantisbt/mantisbt/security/advisories/GHSA-fvjf-68wh-rwp2nvdWEB
mantisbt.org/bugs/view.phpnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000