CVE-2026-34463CWE-79

MantisBT has Stored HTML Injection/XSS via Clone Issue Form

High · published May 19, 2026

CVSS v4.0
8.6
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before the category selector without proper escaping, allowing an attacker able to to inject HTML if they can set the Project's name (which typically requires manager or administrator access level). This issue has been resolved in version 2.28.2.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00493 · 41.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-19T21:57Z
EPSS history
Timeline
  • 19 MAY 21:57Z
    MantisBT has Stored HTML Injection/XSS via Clone Issue Form
    cvelistv5