Read the docs
TI-2026-29333 Aliases CVE-2026-40597GHSA-9c3j-xm6v-j7j3

MantisBT has a Content Security Policy bypass via attachments

Priority LOW 34CWE-358Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via the file_download.php link, will be downloaded with a valid JavaScript MIME type resulting in script execution. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a <script> tag by the browser, due to response header X-Content-Type-Options being set to nosniff, which requires all imported JavaScript files to be a valid JavaScript MIME type. This issue has been fixed in version 2.28.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00498 42nd percentileScored 2026-11-07
Fix Fixed mantisbt (mantisbt): 2.28.2mantisbt/mantisbt (Packagist): 2.28.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mantisbtmantisbtbefore 2.28.22.28.2Patch availableCNA
—mantisbt/mantisbt (Packagist)before 2.28.22.28.2Patch availableGHSA-9c3j-xm6v-j7j3
  • mantisbt Vendormantisbt Affected before 2.28.2 Fixed in 2.28.2 Patch available CNA
  • mantisbt/mantisbt (Packagist) Vendor— Affected before 2.28.2 Fixed in 2.28.2 Patch available GHSA-9c3j-xm6v-j7j3

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*——mantisbt
  • cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* Versions — — ·mantisbt

Remediation

  • Fix · CNA mantisbt (mantisbt) Fixed in 2.28.2
  • Fix · GHSA-9c3j-xm6v-j7j3 mantisbt/mantisbt (Packagist) Fixed in 2.28.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40597
  2. 2026-10-03 Alias added: GHSA-9c3j-xm6v-j7j3

References

Advisory 1

Other 4

  • TI-2017-05251 MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access… CVSS 3.1HIGH 8.8
  • TI-2026-29334 MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page CVSS 4.0MEDIUM 6.9
  • TI-2014-05966 The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2026-27192 MantisBT Bugnote Revision Page Leaks Private Issue Metadata After Issue Access Is Revoked CVSS 4.0MEDIUM 5.3
  • TI-2026-25495 MantisBT: Authorization Bypass in Global Profile Creation CVSS 4.0MEDIUM 5.3
  • TI-2026-26676 MantisBT: Privilege Escalation from Manager to Administrator CVSS 4.0MEDIUM 5.1
See all 144 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences