MantisBT Vulnerable to Stored XSS in File Download

HIGH 7.5CVE-2026-44657 · GHSA-p6fr-rxq7-xcg8 · Published 28/05/2026 · updated 21/07/2026

In short

CVE-2026-44657 is a HIGH (CVSS 7.5) vulnerability affecting mantisbt/mantisbt.
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.6% of all vulnerabilities.
Fix: update to 2.28.2 or later.

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.28.2`	`2.28.2`

Description

Using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

Impact

Cross-site scripting

Patches

26647b2e68ba30b9d7987d4e03d7a16416684bc2

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

NVD description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2.

References

mantisbt/mantisbt security advisory · WEB
mantisbt/mantisbt security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-44657 · ADVISORY
mantisbt/mantisbt commit 26647b2 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/bugs/view.php · WEB

More vulnerabilities in mantisbt/mantisbt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mantisbt/mantisbt

Packagist

< 2.28.2

2.28.2