Packagist/mantisbt/mantisbt CVE-2026-40607: high 7.5, EPSS 0.42%

MantisBT is Vulnerable to Stored XSS in Saved-Filter Owner Column

Action: Upgrade mantisbt/mantisbt to 2.28.2 or later.

composer require mantisbt/mantisbt:2.28.2

Affected

Fixed versions

Sources

• osv: GHSA-f633-865q-2mhh
• nvd: CVE-2026-40607
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-f633-865q-2mhh
• https://github.com/mantisbt/mantisbt/commit/44f490bcf20fd491c1b8f3fc9dd041d8c2a30010
• https://github.com/mantisbt/mantisbt
• https://mantisbt.org/bugs/view.php?id=37015

CVE-2026-40607 · published 2026-05-11T19:35:05Z · modified 2026-09-10T03:51:05.361497190Z · JSON