Packagist/mantisbt/mantisbt CVE-2026-41897: medium 5.3, EPSS 0.28%

MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field

Action: Upgrade mantisbt/mantisbt to 2.28.2 or later.

composer require mantisbt/mantisbt:2.28.2

Affected

Fixed versions

Sources

• osv: GHSA-j7v9-f46r-2rp4
• nvd: CVE-2026-41897
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-j7v9-f46r-2rp4
• https://github.com/mantisbt/mantisbt/commit/c885af13f0b8596714ffe11df757c09f35fbd8f4
• https://github.com/mantisbt/mantisbt
• https://mantisbt.org/bugs/view.php?id=37013

CVE-2026-41897 · published 2026-05-11T19:39:22Z · modified 2026-09-10T03:50:47.202389672Z · JSON