CVE-2026-44657 Details
Description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2.
A stored cross-site scripting vulnerability has been identified in Mantis Bug Tracker (MantisBT) versions prior to 2.28.2. The issue arises in the file_download.php component, where an attacker can upload a crafted XHTML attachment that references a JavaScript file. By using the show_inline=1 parameter and a valid file_show_inline_token CSRF token, the uploaded file can be downloaded with a JavaScript MIME type, bypassing the Content Security Policy and leading to script execution.
Users can update to MantisBT version 2.28.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mantisbt/mantisbt/commit/26647b2e68ba30b9d7987d4e03d7a16416684bc2 | [email protected] | Source CodeVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3 | [email protected] | AdvisoryNot ApplicableVendor |
| https://github.com/mantisbt/mantisbt/security/advisories/GHSA-p6fr-rxq7-xcg8 | [email protected] | AdvisoryRemedyVendor |
| https://mantisbt.org/bugs/view.php?id=37020 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Mantis Bug Tracker | <= 2.28.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |