MantisBT CVE-2026-40597
HIGH
GHSA-9c3j-xm6v-j7j3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H and PR:L because it requires a chained pre-existing XSS plus an authenticated upload account; UI:R as a victim must view the injected page; S:C and C/I:L reflect session-scoped stored XSS.
Primary rating from Vendor (https://github.com/mantisbt/mantisbt).
CVSS VectorVendor: https://github.com/mantisbt/mantisbt
Lifecycle Timeline
5DescriptionCVE.org
Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-src_ directive by uploading a crafted attachment to any issue that, when accessed via the _file_download.php_ link, will be downloaded with a valid JavaScript MIME type resulting in script execution.
The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a <script> tag by the browser, due to response header X-Content-Type-Options being set to _nosniff_, which requires all imported JavaScript files to be a valid JavaScript MIME type.
Impact
Cross-site scripting
Patches
- 9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe
Workarounds
None
Credits
Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.
AnalysisAI
Cross-site scripting via a Content Security Policy bypass in MantisBT (versions <= 2.28.1) lets an authenticated attacker who can upload issue attachments turn a pre-existing HTML/XSS injection into full script execution. By uploading a payload that PHP finfo sniffs as a JavaScript MIME type, the file served by file_download.php is accepted by the browser as a valid script-src source, defeating the CSP and nosniff protections. No public exploit identified at time of analysis; EPSS is low (0.06%, 20th percentile) and this is a chaining/defense-in-depth weakness rather than a standalone RCE.
Technical ContextAI
MantisBT is a widely used open-source PHP bug-tracking application. The root cause (CWE-79, Improper Neutralization of Input During Web Page Generation) here is not a primary injection but a weakening of a mitigation: attachments retrieved through file_download.php were served with their sniffed MIME type, so a file detected by file_create_finfo()/PHP finfo as application/javascript was returned with a JavaScript content type. Because the app sets X-Content-Type-Options: nosniff, the browser normally refuses to execute non-JS MIME types in a <script> tag - but a genuinely JS-typed attachment satisfies that check and also becomes a same-origin script-src source, bypassing the CSP's script-src directive. The affected package is pkg:composer/mantisbt/mantisbt. The patch (commit 9e3bee2e) forces text/* attachments to text/plain and everything else (except audio/video) to application/octet-stream, preventing inline script interpretation.
RemediationAI
Vendor-released patch: upgrade MantisBT to 2.28.2, which contains commit 9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe changing file_download.php so text/* attachments are served as text/plain and all other non-audio/video attachments as application/octet-stream, preventing browser script interpretation. The advisory lists no official workarounds; if immediate upgrade is impossible, compensating controls include restricting attachment upload privileges to trusted users only (reduces who can plant a payload, at the cost of collaboration friction), and fronting file_download.php with a proxy/web-server rule that forces Content-Type: application/octet-stream and Content-Disposition: attachment on downloads (forces files to download rather than render inline, which changes user experience for legitimate inline-viewable attachments). Also prioritize eliminating any primary XSS/HTML-injection vulnerabilities, since this bypass is only exploitable when chained. See the GitHub advisory (https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3) and the patch commit (https://github.com/mantisbt/mantisbt/commit/9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe).
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today