6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40598

CVE-2026-40598: MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, improper escaping of the redirection page (retrieved from the request's Referer header) allows an attacker to inject HTML. While this is generally not directly actionable as modern browsers will URL-encode special characters, on some specific server configurations this could poison the cache, leading to cross-site scripting. This issue has been fixed in version 2.28.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40598

CVE-2026-40598:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	<= 2.28.1	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit b1ebc57763f104eb5f541b7b4d1ce6948168abd9 clearly indicates a fix for a Cross-Site Scripting (XSS) vulnerability in tag_update_page.php. The vulnerability stems from the improper handling of the $t_redirect_page variable, which is populated from the Referer header of the HTTP request. The original code directly echoed this variable into the HTML response, allowing an attacker to inject arbitrary HTML or script content. The patch addresses this by using string_html_specialchars() to sanitize the output. Therefore, the entire tag_update_page.php script is considered the vulnerable component, as the vulnerable code is not encapsulated within a specific function but is part of the script's global execution flow.

Vulnerable functions

tag_update_page.php

tag_update_page.php

The vulnerability exists in the `tag_update_page.php` script. The script directly renders the content of the `$t_redirect_page` variable into an HTML `input` tag's `value` attribute without proper escaping. This variable is derived from the HTTP `Referer` header, which can be controlled by an attacker. By sending a crafted `Referer` header, an attacker could inject malicious HTML and JavaScript, leading to a reflected Cross-Site Scripting (XSS) vulnerability. The patch mitigates this by applying the `string_html_specialchars()` function to the `$t_redirect_page` variable, ensuring that any special HTML characters are properly escaped before being rendered.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.