Medium severityGHSA Advisory· Published May 28, 2026· Updated May 29, 2026

CVE-2026-41897

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. This vulnerability is fixed in 2.28.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mantisbt/mantisbtPackagist	>= 1.0.0, < 2.28.2	2.28.2

Affected products

Mantisbt/MantisbtGHSA
Range: >= 1.0.0, < 2.28.2
ghsa-coords
pkg:composer/mantisbt/mantisbt
Range: >= 1.0.0, < 2.28.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-j7v9-f46r-2rp4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-41897ghsaADVISORY
github.com/mantisbt/mantisbt/commit/c885af13f0b8596714ffe11df757c09f35fbd8f4nvdWEB
github.com/mantisbt/mantisbt/security/advisories/GHSA-j7v9-f46r-2rp4nvdWEB
mantisbt.org/bugs/view.phpnvdWEB

News mentions

MantisBT: Five Bugs Disclosed Together — XSS, Auth Bypass, and Missing Access Controls
Vypr Intelligence · May 28, 2026

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000