CVE-2026-40597 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via the file_download.php link, will be downloaded with a valid JavaScript MIME type resulting in script execution. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a <script> tag by the browser, due to response header X-Content-Type-Options being set to nosniff, which requires all imported JavaScript files to be a valid JavaScript MIME type. This issue has been fixed in version 2.28.2.
A Content Security Policy (CSP) bypass vulnerability has been identified in Mantis Bug Tracker (MantisBT) versions 2.28.1 and prior. This vulnerability allows an attacker to execute scripts by exploiting existing Cross-Site Scripting (XSS) or HTML injection flaws. By uploading a malicious attachment to an issue, which is then downloaded through the file_download.php link, the attachment can be executed as a script if it is recognized as a valid JavaScript MIME type by PHP's fileinfo function. The issue arises because the X-Content-Type-Options header is set to nosniff, requiring JavaScript files to have a valid MIME type to be executed.
Users can update to MantisBT version 2.28.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 22, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe | [email protected] | Source CodeVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3 | [email protected] | AdvisoryRemedyVendor |
| https://mantisbt.org/bugs/view.php?id=37016 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-358 | Improperly Implemented Security Check for Standard | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mantis Bug Tracker | <= 2.28.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 22, 2026 | New CVE Received | [email protected] |