MantisBT Vulnerable to Stored XSS in File Download

ALTO 7.5CVE-2026-44657 · GHSA-p6fr-rxq7-xcg8 · Published 28/05/2026 · updated 21/07/2026

In breve

CVE-2026-44657 è una vulnerabilità ALTO (CVSS 7.5) che riguarda mantisbt/mantisbt.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.35%, superiore al 28.6% delle vulnerabilità.
Correzione: aggiornare a 2.28.2 o successiva.

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.28.2`	`2.28.2`

Description

Using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

Impact

Cross-site scripting

Patches

26647b2e68ba30b9d7987d4e03d7a16416684bc2

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

NVD description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2.

References

mantisbt/mantisbt security advisory · WEB
mantisbt/mantisbt security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-44657 · ADVISORY
mantisbt/mantisbt commit 26647b2 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/bugs/view.php · WEB

Altre vulnerabilità di mantisbt/mantisbt

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mantisbt/mantisbt

Packagist

< 2.28.2

2.28.2