Skip to content
Threat Feed
Subscribe

Product

MantisBT

4 briefs RSS
high threat

MantisBT Vulnerable to Stored XSS in File Download

MantisBT is vulnerable to stored cross-site scripting (XSS) via file_download.php by using the `show_inline=1` parameter with a valid CSRF token to upload a crafted XHTML attachment referencing a JavaScript attachment, leading to arbitrary code execution.

mantisbt/mantisbt xss mantisbt github advisory
2r 1t
high advisory

MantisBT Content Security Policy Bypass via Attachment Upload (CVE-2026-40597)

A content security policy bypass vulnerability, CVE-2026-40597, exists in MantisBT versions 2.28.1 and earlier, allowing an attacker to bypass the _script-src_ directive by uploading a crafted attachment that, when downloaded, executes as JavaScript due to MIME type sniffing, given a pre-existing XSS / HTML injection vulnerability.

mantisbt +1 csp-bypass xss attachment mime-sniffing
2r 1t
high advisory

MantisBT Stored XSS Vulnerability via Tag Timeline Display

A stored HTML injection vulnerability (CVE-2026-33548) exists in MantisBT version 2.28.0, allowing attackers to inject HTML and execute arbitrary JavaScript by manipulating tag names displayed in the timeline due to improper escaping.

MantisBT xss html-injection cve-2026-33548 webserver
2r 1t
critical advisory

MantisBT Authentication Bypass via SOAP API on MySQL

MantisBT instances running on MySQL are vulnerable to an authentication bypass in the SOAP API due to improper type checking on the password parameter, allowing attackers with a valid username to log in without the actual password.

MantisBT authentication-bypass soap-api
3r 1t