5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41897

CVE-2026-41897: MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field

Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field.

Impact

Cross-site scripting (XSS)

Patches

c885af13f0b8596714ffe11df757c09f35fbd8f4

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41897

CVE-2026-41897:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	>= 1.0.0, < 2.28.2	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a reflected Cross-Site Scripting (XSS) issue in MantisBT. The entry point for the attack is the return_dynamic_filters.php script, which processes the filter_target GET parameter. The script failed to properly validate this parameter.

An attacker could craft a malicious filter_target value. This value, after partial processing, is passed as a field identifier to other functions responsible for rendering HTML form elements. Specifically, the functions print_filter_custom_field and print_filter_custom_field_date in core/filter_form_api.php would receive this malicious identifier and embed it without escaping into the name attribute of an <input> or <select> tag, leading to the execution of arbitrary JavaScript in the user's browser.

The patch addresses the vulnerability at two levels. First, it adds validation in return_dynamic_filters.php to ensure the custom field ID is numeric, thus preventing the malicious string from propagating. Second, as a defense-in-depth measure, it adds output escaping using string_html_specialchars in the functions print_filter_custom_field, print_filter_custom_field_date, and print_date_selection_set to ensure that even if un-sanitized data reaches them, it will not result in an XSS vulnerability.

Vulnerable functions

print_filter_custom_field

core/filter_form_api.php

The function is vulnerable to reflected XSS. The parameter `$p_field_id` is used to construct the `name` attribute of an HTML `<input>` tag. The value of this parameter was not properly sanitized before being embedded in the HTML, allowing an attacker to inject arbitrary HTML and script code. The value for `$p_field_id` originates from the `filter_target` request parameter processed by `return_dynamic_filters.php`.

print_filter_custom_field_date

core/filter_form_api.php

This function is vulnerable to reflected XSS in a way similar to `print_filter_custom_field`. The `$p_field_id` parameter, without proper sanitization, is used to create the `name` attribute of a `<select>` HTML tag. This allows for the injection of malicious scripts.

print_date_selection_set

core/date_api.php

This function was found to have a similar XSS vulnerability. The `$p_name` parameter was used directly in the `name` attribute of a `<select>` tag without being escaped. The patch applies `string_html_specialchars` to `$p_name` to prevent injection of malicious content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.