Cross-Site Scripting Vulnerability in Mantis Bug Tracker Affecting Multiple Versions
CVE-2026-40596

7.2HIGH

Key Information:

Vendor: Mantisbt
Status: Mantisbt
Vendor: CVE Published:; 22 May 2026

What is CVE-2026-40596?

Mantis Bug Tracker versions 2.11.0 to 2.28.1 are vulnerable to Cross-Site Scripting (XSS) due to a flaw that allows authenticated users to inject arbitrary HTML via the font family update feature. This vulnerability permits attackers to execute scripts on all pages of MantisBT, potentially leading to account compromise if combined with other existing vulnerabilities such as a Content Security Policy (CSP) bypass. The issue has been addressed in version 2.28.2 of Mantis Bug Tracker.