{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/mantisbt/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mantisbt/mantisbt (\u003c= 2.28.1)"],"_cs_severities":["high"],"_cs_tags":["xss","mantisbt","github advisory"],"_cs_type":"threat","_cs_vendors":["composer"],"content_html":"\u003cp\u003eMantisBT, a web-based bug tracking system, is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability exists in the \u003ccode\u003efile_download.php\u003c/code\u003e script. By exploiting this flaw, an attacker can inject malicious JavaScript code into the application, which will be executed in the context of other users' browsers when they access the affected functionality. The vulnerability is triggered when processing file downloads, specifically when the \u003ccode\u003eshow_inline=1\u003c/code\u003e parameter is used in conjunction with a valid \u003ccode\u003efile_show_inline_token\u003c/code\u003e CSRF token. This allows an attacker to upload a crafted XHTML attachment that references a JavaScript attachment. The vulnerability affects MantisBT versions 2.28.1 and earlier. This can lead to account takeover, sensitive data leakage, and other malicious activities.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to MantisBT as a user with permissions to upload attachments.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious JavaScript file (e.g., \u003ccode\u003eevil.js\u003c/code\u003e) containing the XSS payload.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious XHTML file (e.g., \u003ccode\u003eevil.xhtml\u003c/code\u003e) that includes the JavaScript file using \u003ccode\u003e\u0026lt;script src=\u0026quot;evil.js\u0026quot;\u0026gt;\u0026lt;/script\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker obtains a valid CSRF token for the \u003ccode\u003efile_show_inline_token\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eAttacker uploads both the \u003ccode\u003eevil.js\u003c/code\u003e and \u003ccode\u003eevil.xhtml\u003c/code\u003e files as attachments to a MantisBT issue.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a request to \u003ccode\u003efile_download.php\u003c/code\u003e with the \u003ccode\u003eshow_inline=1\u003c/code\u003e parameter, the valid CSRF token, and the file IDs of the uploaded \u003ccode\u003eevil.xhtml\u003c/code\u003e attachment.\u003c/li\u003e\n\u003cli\u003eA victim user clicks a link (or is redirected) to the crafted \u003ccode\u003efile_download.php\u003c/code\u003e URL.\u003c/li\u003e\n\u003cli\u003eThe server serves the \u003ccode\u003eevil.xhtml\u003c/code\u003e file inline, which executes the embedded \u003ccode\u003eevil.js\u003c/code\u003e JavaScript in the victim's browser, allowing the attacker to perform actions on behalf of the victim.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to a variety of malicious activities, including session hijacking, defacement of the MantisBT interface, theft of sensitive information, or further exploitation of the MantisBT server or the victim's machine. Given the nature of bug tracking systems, successful exploitation could impact multiple users within an organization, potentially leading to widespread compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch provided by MantisBT (26647b2e68ba30b9d7987d4e03d7a16416684bc2) to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect MantisBT XSS via file_download.php\u0026quot; to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to \u003ccode\u003efile_download.php\u003c/code\u003e with the \u003ccode\u003eshow_inline=1\u003c/code\u003e parameter and potentially malicious content in the request.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-11T19:42:20Z","date_published":"2026-05-11T19:42:20Z","id":"https://feed.craftedsignal.io/briefs/2026-05-mantisbt-xss/","summary":"MantisBT is vulnerable to stored cross-site scripting (XSS) via file_download.php by using the `show_inline=1` parameter with a valid CSRF token to upload a crafted XHTML attachment referencing a JavaScript attachment, leading to arbitrary code execution.","title":"MantisBT Vulnerable to Stored XSS in File Download","url":"https://feed.craftedsignal.io/briefs/2026-05-mantisbt-xss/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mantisbt (\u003c= 2.28.1)","mantisbt/mantisbt"],"_cs_severities":["high"],"_cs_tags":["csp-bypass","xss","attachment","mime-sniffing"],"_cs_type":"advisory","_cs_vendors":["MantisBT"],"content_html":"\u003cp\u003eMantisBT, a web-based bug tracking system, is vulnerable to a content security policy (CSP) bypass. Specifically, the vulnerability, identified as CVE-2026-40597, allows an attacker to circumvent the CSP's \u003ccode\u003escript-src\u003c/code\u003e directive. This is achieved by uploading a specially crafted attachment to a MantisBT issue. The vulnerability exists in MantisBT versions 2.28.1 and earlier. An attacker must first inject HTML or XSS. When the attachment is accessed via the \u003ccode\u003efile_download.php\u003c/code\u003e link, PHP's finfo mechanism incorrectly identifies it as a valid JavaScript MIME type. Because of this, the browser executes the payload within the context of the MantisBT application. This can lead to Cross-Site Scripting (XSS) attacks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies or exploits an existing XSS or HTML injection vulnerability in MantisBT.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload designed to execute JavaScript code within the browser, and ensures that it will be sniffed as JavaScript by PHP's \u003ccode\u003efinfo\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the crafted payload as an attachment to a MantisBT issue using the standard attachment upload functionality.\u003c/li\u003e\n\u003cli\u003eMantisBT stores the attachment, associating it with the specific issue.\u003c/li\u003e\n\u003cli\u003eA user (victim) accesses the issue containing the malicious attachment.\u003c/li\u003e\n\u003cli\u003eThe user clicks the \u003ccode\u003efile_download.php\u003c/code\u003e link associated with the uploaded attachment.\u003c/li\u003e\n\u003cli\u003eThe webserver serves the attachment via \u003ccode\u003efile_download.php\u003c/code\u003e. PHP's \u003ccode\u003efinfo\u003c/code\u003e incorrectly identifies the MIME type of the file as a valid JavaScript MIME type.\u003c/li\u003e\n\u003cli\u003eThe browser imports the attachment as a \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e tag and executes the attacker-controlled JavaScript code within the security context of the MantisBT domain, leading to XSS.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability, in conjunction with a pre-existing XSS or HTML injection, allows an attacker to execute arbitrary JavaScript code in the context of the MantisBT application. This can lead to session hijacking, defacement of the MantisBT interface, sensitive information theft, or other malicious actions performed on behalf of the victim user. Given the wide use of MantisBT in software development and IT support organizations, a successful attack could impact a significant number of users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade MantisBT to a patched version beyond 2.28.1 as indicated in the advisory (\u003ca href=\"https://github.com/advisories/GHSA-9c3j-xm6v-j7j3)\"\u003ehttps://github.com/advisories/GHSA-9c3j-xm6v-j7j3)\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect MantisBT CSP Bypass via JavaScript MIME Sniffing\u003c/code\u003e to detect attempts to exploit CVE-2026-40597.\u003c/li\u003e\n\u003cli\u003eReview and harden input validation and output encoding mechanisms to prevent XSS vulnerabilities, which are a prerequisite for exploiting CVE-2026-40597.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-11T19:35:30Z","date_published":"2026-05-11T19:35:30Z","id":"https://feed.craftedsignal.io/briefs/2026-05-mantisbt-csp-bypass/","summary":"A content security policy bypass vulnerability, CVE-2026-40597, exists in MantisBT versions 2.28.1 and earlier, allowing an attacker to bypass the _script-src_ directive by uploading a crafted attachment that, when downloaded, executes as JavaScript due to MIME type sniffing, given a pre-existing XSS / HTML injection vulnerability.","title":"MantisBT Content Security Policy Bypass via Attachment Upload (CVE-2026-40597)","url":"https://feed.craftedsignal.io/briefs/2026-05-mantisbt-csp-bypass/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MantisBT"],"_cs_severities":["high"],"_cs_tags":["mantisbt","xss","html-injection","cve-2026-33548","webserver"],"_cs_type":"advisory","_cs_vendors":["MantisBT"],"content_html":"\u003cp\u003eA stored cross-site scripting (XSS) vulnerability has been identified in MantisBT version 2.28.0. This flaw, tracked as CVE-2026-33548, stems from the improper handling of tag names retrieved from the history when displaying them in the timeline (my_view_page.php). Specifically, the application fails to adequately escape HTML entities within the tag names, allowing an attacker to inject malicious HTML code. If Content Security Policy (CSP) settings are permissive, this injected HTML can be leveraged to execute arbitrary JavaScript code within the context of a user's browser. This can lead to session hijacking, defacement, or other malicious activities. The vulnerability was discovered and responsibly reported by Vishal Shukla. Defenders should upgrade or implement workarounds.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker with appropriate privileges logs into a vulnerable MantisBT instance.\u003c/li\u003e\n\u003cli\u003eThe attacker creates a new tag with a malicious payload embedded in the tag name (e.g., \u003ccode\u003e\u0026lt;img src=x onerror=alert(1)\u0026gt;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker associates the malicious tag with an issue.\u003c/li\u003e\n\u003cli\u003eThe attacker renames the malicious tag, further storing the payload in the history.\u003c/li\u003e\n\u003cli\u003eA user views the issue's timeline on \u003ccode\u003emy_view_page.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application retrieves the tag name from the history without proper escaping.\u003c/li\u003e\n\u003cli\u003eThe malicious HTML is rendered in the user's browser.\u003c/li\u003e\n\u003cli\u003eIf CSP allows, the injected JavaScript executes, leading to XSS.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other MantisBT users' browsers. This can lead to sensitive information disclosure, such as session cookies, which can then be used to hijack user accounts. The impact could also include defacement of the MantisBT interface or redirection of users to malicious websites. The vulnerability affects MantisBT 2.28.0 and requires immediate patching or mitigation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to a patched version of MantisBT that includes the fix f32787c14d4518476fe7f05f992dbfe6eaccd815.\u003c/li\u003e\n\u003cli\u003eApply the suggested workaround by wrapping \u003ccode\u003e$this-\u0026gt;tag_name\u003c/code\u003e in a \u003ccode\u003estring_html_specialchars()\u003c/code\u003e call in \u003ccode\u003eIssueTagTimelineEvent::html()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;MantisBT Tag Based XSS Attempt\u0026quot; to detect potential exploitation attempts within web server logs.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for requests to \u003ccode\u003emy_view_page.php\u003c/code\u003e containing suspicious tag names with HTML entities as detected by the Sigma rule \u0026quot;MantisBT Suspicious Tag\u0026quot;.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-mantisbt-xss/","summary":"A stored HTML injection vulnerability (CVE-2026-33548) exists in MantisBT version 2.28.0, allowing attackers to inject HTML and execute arbitrary JavaScript by manipulating tag names displayed in the timeline due to improper escaping.","title":"MantisBT Stored XSS Vulnerability via Tag Timeline Display","url":"https://feed.craftedsignal.io/briefs/2024-01-03-mantisbt-xss/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MantisBT"],"_cs_severities":["critical"],"_cs_tags":["mantisbt","authentication-bypass","soap-api"],"_cs_type":"advisory","_cs_vendors":["MantisBT"],"content_html":"\u003cp\u003eMantisBT, a widely used web-based bug tracking system, is susceptible to a critical authentication bypass vulnerability (CVE-2026-30849) affecting instances utilizing MySQL or compatible databases. This flaw stems from inadequate type checking on the password parameter within the SOAP API. Specifically, the vulnerability exists in MantisBT versions prior to 2.28.1. An attacker who knows a valid username can exploit this weakness to gain unauthorized access to the SOAP API, circumventing the need for the correct password. Other database backends are not affected due to their stricter type handling. Successful exploitation grants the attacker the ability to execute any API function accessible to the compromised user, posing a significant risk of data breaches, system compromise, and unauthorized modifications.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerable MantisBT instance running on MySQL or a compatible database.\u003c/li\u003e\n\u003cli\u003eAttacker obtains a valid username for the MantisBT instance (e.g., through OSINT or social engineering).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious SOAP envelope containing the target username and a manipulated password parameter designed to exploit the type checking vulnerability.\u003c/li\u003e\n\u003cli\u003eAttacker sends the crafted SOAP request to the MantisBT instance's SOAP API endpoint.\u003c/li\u003e\n\u003cli\u003eThe vulnerable MantisBT instance improperly processes the password parameter due to insufficient type validation.\u003c/li\u003e\n\u003cli\u003eThe MantisBT instance authenticates the attacker as the targeted user without requiring the correct password.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the authenticated SOAP API session to execute privileged API functions.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates sensitive bug data, modifies bug reports, or performs other malicious actions within the MantisBT system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to a MantisBT instance. The impact includes potential data breaches involving sensitive bug reports, project information, and user data. Attackers can modify or delete bug reports, disrupt project workflows, or escalate their access to other systems connected to the MantisBT instance. While the exact number of affected MantisBT installations is unknown, the widespread use of MantisBT across various sectors suggests a potentially broad impact. Disabling the SOAP API mitigates the risk, but still allows the attacker to retrieve user account information including email address and real name.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade MantisBT to version 2.28.1 or later to patch CVE-2026-30849 and remediate the authentication bypass vulnerability.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, disable the SOAP API as a workaround, referencing the \u003ca href=\"https://mantisbt.org/docs/master/en-US/Admin_Guide/html-desktop/#admin.config.api.disable\"\u003eMantisBT documentation\u003c/a\u003e .\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious SOAP API requests containing unusual password parameters indicative of exploitation attempts. Deploy a webserver rule to detect unusual password parameters in SOAP API requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T12:00:00Z","date_published":"2024-01-02T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-mantisbt-auth-bypass/","summary":"MantisBT instances running on MySQL are vulnerable to an authentication bypass in the SOAP API due to improper type checking on the password parameter, allowing attackers with a valid username to log in without the actual password.","title":"MantisBT Authentication Bypass via SOAP API on MySQL","url":"https://feed.craftedsignal.io/briefs/2024-01-mantisbt-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - MantisBT","version":"https://jsonfeed.org/version/1.1"}