mediumVulnerability
CVE-2026-41897
Lack of validation of filter_target parameter on return_dynamic_filters.php (normally used as an AJAX in View Issues Page) allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. ### Impact Cross-site scripting (XSS) ### Patches - c885af13f0b8596714ffe11df757c09f35fbd8f4 ### Workarounds None ### Credits Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
Properties
- ghsa_id
- GHSA-j7v9-f46r-2rp4
- severity
- medium
- summary
- MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
- epss_score
- 0.00281
- cve_id
- CVE-2026-41897
- is_ghsa_only
- false
- ghsa_published
- 2026-05-11T19:39:22Z
- source_url
- https://github.com/advisories/GHSA-j7v9-f46r-2rp4
- epss_percentile
- 0.20307
- ghsa_updated
- 2026-05-11T19:39:23Z
Related Entities (5)
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]composer/mantisbt/mantisbt
AFFECTS (1)
→[Software]composer/mantisbt/mantisbt
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph