8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34463

CVE-2026-34463: MantisBT has Stored HTML Injection/XSS via Clone Issue Form

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior contain a Stored XSS vulnerability. When cloning an issue originating from a Project other than the current one, the clone form (bug_report_page.php) prepends the source Project name before the category selector without proper escaping, allowing an attacker able to to inject HTML if they can set the Project's name (which typically requires manager or administrator access level). This issue has been resolved in version 2.28.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34463

CVE-2026-34463:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	<= 2.28.1	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the bug_report_page.php script. When a user clones an issue from a different project, the name of the source project is displayed on the 'Clone Issue' form. The original code took the project name, retrieved via the project_get_field() function, and directly echoed it into the HTML page. This created a stored Cross-Site Scripting (XSS) vulnerability because a project name containing malicious HTML or script tags would be rendered by the browser. The vulnerability is triggered in the main body of the bug_report_page.php script, not within a specific user-defined function. The fix involves wrapping the project name with the string_html_specialchars() function to ensure that any special HTML characters are properly escaped, preventing the browser from interpreting them as code.

Vulnerable functions

bug_report_page.php

bug_report_page.php

The vulnerability is in the main body of the `bug_report_page.php` script. The script directly prints the project name using `echo` without proper HTML escaping. An attacker who can control the project name can inject malicious HTML/JavaScript. The patch fixes this by using `string_html_specialchars()` to escape the project name before it is rendered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.