Which versions of MantisBT are affected by CVE-2026-44657?

MantisBT versions before 2.28.2 contain a stored cross-site scripting vulnerability allowing authenticated users to upload malicious attachments that execute arbitrary JavaScript in the browsers of…. A patch is available.

How to fix or mitigate CVE-2026-44657?

Within 24 hours, identify all MantisBT deployments in your environment and document current versions and user counts. Within 7 days, upgrade all MantisBT instances to version 2.28.2 or later; prioritize systems with sensitive project data or high user counts. Within 30 days, verify patch deployment across all instances and review access logs for any suspicious attachment uploads or file downloads via file_download.php to confirm no exploitation occurred before patching.

MantisBT CVE-2026-44657

Q: What is the CVSS score of CVE-2026-44657?

CVE-2026-44657 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33023 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 https://github.com/mantisbt/mantisbt

GHSA-p6fr-rxq7-xcg8

PHP XSS CSRF

7.5

CVSS 4.0 · Vendor: https://github.com/mantisbt/mantisbt

Severity by source

Vendor (https://github.com/mantisbt/mantisbt) PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Authenticated uploader (PR:L) and victim must open the link (UI:R); XSS executing in another user's session crosses a trust boundary (S:C) with high confidentiality (session/token theft) and limited integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/mantisbt/mantisbt).

CVSS VectorVendor: https://github.com/mantisbt/mantisbt

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:44 vuln.today

Analysis Generated

Jul 23, 2026 - 23:44 vuln.today

CVSS changed

May 28, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

May 11, 2026 - 19:40 cve.org

HIGH 7.5

CVE Published

May 11, 2026 - 19:40 nvd

HIGH

DescriptionCVE.org

Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

Impact

Cross-site scripting

Patches

26647b2e68ba30b9d7987d4e03d7a16416684bc2

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

AnalysisAI

Stored/DOM cross-site scripting in MantisBT before 2.28.2 lets an authenticated attacker achieve script execution by uploading a crafted XHTML attachment that references a JavaScript attachment and retrieving it via file_download.php with show_inline=1 and a valid file_show_inline_token CSRF token. The companion advisory (GHSA-9c3j-xm6v-j7j3) shows the same download path can be abused to bypass the Content-Security-Policy script-src directive by serving an attachment with a JavaScript MIME type, turning any HTML-injection primitive into full script execution. No public exploit has been identified at time of analysis and EPSS is low (0.06%, 20th percentile), consistent with responsible disclosure by researcher siunam rather than in-the-wild abuse.

Technical ContextAI

MantisBT is a PHP-based open-source bug-tracking web application (distributed as the composer/mantisbt package). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable component is file_download.php, which decides whether an uploaded attachment is served inline versus as a forced download and what Content-Type header to apply. Before the fix, when show_inline was requested the handler served attachments using their sniffed MIME type without normalizing dangerous types, so an XHTML file (rendered as active HTML) or a file that PHP finfo sniffs as a JavaScript MIME type would be interpreted and executed by the browser rather than treated as an opaque download. Because browsers honor X-Content-Type-Options: nosniff, the CSP-bypass variant specifically requires the payload to be sniffed as a genuine JavaScript MIME type so it can be imported through a <script> tag.

RemediationAI

Vendor-released patch: upgrade to MantisBT 2.28.2, which contains the fixes (commits 26647b2e68ba30b9d7987d4e03d7a16416684bc2 and 9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe) that normalize the Content-Type of downloaded attachments - forcing text/* content to text/plain and all non-audio/video types to application/octet-stream so browsers no longer execute HTML or JavaScript served from file_download.php. The advisories explicitly state there are no supported workarounds, so patching is the required action; refer to https://github.com/mantisbt/mantisbt/security/advisories/GHSA-p6fr-rxq7-xcg8 and https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3. If upgrading cannot be done immediately, reduce exposure by restricting attachment-upload rights to trusted accounts and limiting reporter/account self-registration (trade-off: hampers legitimate external bug reporters), and consider a reverse-proxy rule that forces Content-Disposition: attachment / application/octet-stream on file_download.php responses (trade-off: breaks intended inline preview of benign attachments).