CVE-2026-44657

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker (MantisBT) versions prior to 2.28.2

Description An issue exists where an attacker can execute code via cross-site scripting (XSS) by uploading a crafted XHTML attachment that references a JavaScript attachment. This is achieved by using the show inline=1 parameter and a valid file show inline token CSRF token on the 'file download.php' endpoint. The attack bypasses the Content Security Policy's script-src directive if the uploaded payload is recognized as a valid JavaScript MIME type by the file create finfo() function, as the X-Content-Type-Options nosniff header prevents the browser from importing non-JavaScript MIME types in a script tag.

Recommendations Update to version 2.28.2.