High severityGHSA Advisory· Published May 28, 2026· Updated May 29, 2026

CVE-2026-44655

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.3.0 to 2.28.1, unescaped Project Name allows an attacker that can set it (which typically requires manager or administrator access level) to inject HTML in Move Attachments admin page. This vulnerability is fixed in 2.28.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mantisbt/mantisbtPackagist	>= 1.3.0, < 2.28.2	2.28.2

Affected products

Mantisbt/MantisbtGHSA
Range: >= 1.3.0, <= 2.28.1
ghsa-coords
pkg:composer/mantisbt/mantisbt
Range: >= 1.3.0, < 2.28.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-7mqj-8gj2-cg59ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-44655ghsaADVISORY
github.com/mantisbt/mantisbt/commit/5cb4b469295889f5d2b01677c9bf82c143e0fdaanvdWEB
github.com/mantisbt/mantisbt/security/advisories/GHSA-7mqj-8gj2-cg59nvdWEB
mantisbt.org/bugs/view.phpghsaWEB

News mentions

MantisBT: Five Bugs Disclosed Together — XSS, Auth Bypass, and Missing Access Controls
Vypr Intelligence · May 28, 2026

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000