CVE-2026-44655: MantisBT: Stored XSS on Move Attachments Admin Page

Synopsis

Stored cross-site scripting (XSS) affects MantisBT versions 1.3.0 through 2.28.1. An authenticated user with manager or administrator privileges can inject arbitrary HTML into the Move Attachments admin page by setting a malicious Project Name, which is then rendered unescaped to any admin who views that page. Successful exploitation allows the attacker to execute scripts in the browser of another admin, enabling session theft, credential harvesting, or unauthorized actions performed in the victim's context. Note: the description states this is fixed in 2.28.2, but no fix version has been published to the advisory record yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MantisBT instance over the network to set a malicious Project Name and trigger rendering on the Move Attachments admin page.

• AuthenticationRequired

  A manager- or administrator-level account is needed to set the Project Name; a low-privilege account is not sufficient.

• Victim interactionNot required

  No victim interaction is required from the perspective of the attacker injecting the payload; the XSS fires when any admin loads the Move Attachments page.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special race conditions or environmental prerequisites beyond having the required account.

Blast Radius

• An attacker can read the victim admin's active session tokens, enabling account takeover without needing credentials.
• Injected scripts can issue authenticated requests on behalf of the victim, modifying project settings, user roles, or issue data within MantisBT.
• The attacker can harvest credentials or other sensitive data entered by the victim while the malicious script is active in their browser session.
• Full confidentiality, integrity, and availability of the vulnerable MantisBT instance are at risk within the scope of the authenticated victim's permissions.