Packagist/mantisbt/mantisbt CVE-2026-34463: high 8.6, EPSS 0.44%

MantisBT is Vulnerable to Stored HTML Injection/XSS in Clone Issue Form

Action: Upgrade mantisbt/mantisbt to 2.28.2 or later.

composer require mantisbt/mantisbt:2.28.2

Affected

Fixed versions

Sources

• osv: GHSA-fvjf-68wh-rwp2
• nvd: CVE-2026-34463
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-fvjf-68wh-rwp2
• https://github.com/mantisbt/mantisbt/commit/df22697ae497ddd93f3d9132fdf4979db8d081cd
• https://github.com/mantisbt/mantisbt
• https://mantisbt.org/bugs/view.php?id=36986

CVE-2026-34463 · published 2026-05-11T19:32:11Z · modified 2026-09-10T03:51:05.552621253Z · JSON