CVE-2026-41897: Mantisbt

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.0.0 to 2.28.1, lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. This vulnerability is fixed in 2.28.2.

Affected products

• Mantisbt Mantisbt: from 1.0.0, before 2.28.2 (fixed in 2.28.2)

Published 2026-05-28. Last modified 2026-06-17.