MantisBT Vulnerable to Stored XSS in File Download

高危 7.5CVE-2026-44657 · GHSA-p6fr-rxq7-xcg8 · Published 28/05/2026 · updated 21/07/2026

要点

CVE-2026-44657 是影响 mantisbt/mantisbt 的高危 (CVSS 7.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.35%，高于 28.6% 的漏洞。
修复：升级到 2.28.2 或更高版本。

Package	Affected versions	Patched versions
mantisbt/mantisbt Packagist	`< 2.28.2`	`2.28.2`

Description

Using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

Impact

Cross-site scripting

Patches

26647b2e68ba30b9d7987d4e03d7a16416684bc2

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

NVD description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2.

References

mantisbt/mantisbt security advisory · WEB
mantisbt/mantisbt security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-44657 · ADVISORY
mantisbt/mantisbt commit 26647b2 · WEB
mantisbt/mantisbt · PACKAGE
mantisbt.org/bugs/view.php · WEB

mantisbt/mantisbt 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mantisbt/mantisbt

Packagist

< 2.28.2

2.28.2