Stored XSS Vulnerability in Mantis Bug Tracker by MantisBT
CVE-2026-34463
8.6HIGH
What is CVE-2026-34463?
Mantis Bug Tracker (MantisBT), an open-source issue tracker, is affected by a stored XSS vulnerability in versions 2.28.1 and earlier. This issue arises when cloning an issue from a different project—in the clone form (bug_report_page.php), the source project name is not properly escaped before displaying, allowing for HTML injection by users with project management privileges. This vulnerability can lead to unauthorized script execution within the web application. The issue has been resolved in version 2.28.2, which users are encouraged to upgrade to in order to ensure continued security.
Affected Version(s)
mantisbt < 2.28.2