https://feed.craftedsignal.io/products/mantisbt/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 11 May 2026 19:42:20 +0000https://feed.craftedsignal.io/briefs/2026-05-mantisbt-xss/Mon, 11 May 2026 19:42:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-mantisbt-xss/MantisBT is vulnerable to stored cross-site scripting (XSS) via file_download.php by using the `show_inline=1` parameter with a valid CSRF token to upload a crafted XHTML attachment referencing a JavaScript attachment, leading to arbitrary code execution.MantisBT, a web-based bug tracking system, is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability exists in the file_download.php script. By exploiting this flaw, an attacker can inject malicious JavaScript code into the application, which will be executed in the context of other users' browsers when they access the affected functionality. The vulnerability is triggered when processing file downloads, specifically when the show_inline=1 parameter is used in conjunction with a valid file_show_inline_token CSRF token. This allows an attacker to upload a crafted XHTML attachment that references a JavaScript attachment. The vulnerability affects MantisBT versions 2.28.1 and earlier. This can lead to account takeover, sensitive data leakage, and other malicious activities.

Attack Chain

1. Attacker authenticates to MantisBT as a user with permissions to upload attachments.
2. Attacker crafts a malicious JavaScript file (e.g., evil.js) containing the XSS payload.
3. Attacker crafts a malicious XHTML file (e.g., evil.xhtml) that includes the JavaScript file using <script src="evil.js"></script>.
4. Attacker obtains a valid CSRF token for the file_show_inline_token parameter.
5. Attacker uploads both the evil.js and evil.xhtml files as attachments to a MantisBT issue.
6. Attacker crafts a request to file_download.php with the show_inline=1 parameter, the valid CSRF token, and the file IDs of the uploaded evil.xhtml attachment.
7. A victim user clicks a link (or is redirected) to the crafted file_download.php URL.
8. The server serves the evil.xhtml file inline, which executes the embedded evil.js JavaScript in the victim's browser, allowing the attacker to perform actions on behalf of the victim.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of a victim's browser. This can lead to a variety of malicious activities, including session hijacking, defacement of the MantisBT interface, theft of sensitive information, or further exploitation of the MantisBT server or the victim's machine. Given the nature of bug tracking systems, successful exploitation could impact multiple users within an organization, potentially leading to widespread compromise.

Recommendation

• Apply the patch provided by MantisBT (26647b2e68ba30b9d7987d4e03d7a16416684bc2) to remediate the vulnerability.
• Deploy the Sigma rule "Detect MantisBT XSS via file_download.php" to identify potential exploitation attempts.
• Monitor web server logs for requests to file_download.php with the show_inline=1 parameter and potentially malicious content in the request.

]]>highthreatxssmantisbtgithub advisoryhttps://feed.craftedsignal.io/briefs/2026-05-mantisbt-csp-bypass/Mon, 11 May 2026 19:35:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-mantisbt-csp-bypass/A content security policy bypass vulnerability, CVE-2026-40597, exists in MantisBT versions 2.28.1 and earlier, allowing an attacker to bypass the _script-src_ directive by uploading a crafted attachment that, when downloaded, executes as JavaScript due to MIME type sniffing, given a pre-existing XSS / HTML injection vulnerability.MantisBT, a web-based bug tracking system, is vulnerable to a content security policy (CSP) bypass. Specifically, the vulnerability, identified as CVE-2026-40597, allows an attacker to circumvent the CSP's script-src directive. This is achieved by uploading a specially crafted attachment to a MantisBT issue. The vulnerability exists in MantisBT versions 2.28.1 and earlier. An attacker must first inject HTML or XSS. When the attachment is accessed via the file_download.php link, PHP's finfo mechanism incorrectly identifies it as a valid JavaScript MIME type. Because of this, the browser executes the payload within the context of the MantisBT application. This can lead to Cross-Site Scripting (XSS) attacks.

Attack Chain

1. Attacker identifies or exploits an existing XSS or HTML injection vulnerability in MantisBT.
2. Attacker crafts a malicious payload designed to execute JavaScript code within the browser, and ensures that it will be sniffed as JavaScript by PHP's finfo.
3. Attacker uploads the crafted payload as an attachment to a MantisBT issue using the standard attachment upload functionality.
4. MantisBT stores the attachment, associating it with the specific issue.
5. A user (victim) accesses the issue containing the malicious attachment.
6. The user clicks the file_download.php link associated with the uploaded attachment.
7. The webserver serves the attachment via file_download.php. PHP's finfo incorrectly identifies the MIME type of the file as a valid JavaScript MIME type.
8. The browser imports the attachment as a <script> tag and executes the attacker-controlled JavaScript code within the security context of the MantisBT domain, leading to XSS.

Impact

Successful exploitation of this vulnerability, in conjunction with a pre-existing XSS or HTML injection, allows an attacker to execute arbitrary JavaScript code in the context of the MantisBT application. This can lead to session hijacking, defacement of the MantisBT interface, sensitive information theft, or other malicious actions performed on behalf of the victim user. Given the wide use of MantisBT in software development and IT support organizations, a successful attack could impact a significant number of users.

Recommendation

• Upgrade MantisBT to a patched version beyond 2.28.1 as indicated in the advisory (https://github.com/advisories/GHSA-9c3j-xm6v-j7j3).
• Deploy the Sigma rule Detect MantisBT CSP Bypass via JavaScript MIME Sniffing to detect attempts to exploit CVE-2026-40597.
• Review and harden input validation and output encoding mechanisms to prevent XSS vulnerabilities, which are a prerequisite for exploiting CVE-2026-40597.

]]>highadvisorycsp-bypassxssattachmentmime-sniffinghttps://feed.craftedsignal.io/briefs/2024-01-03-mantisbt-xss/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-mantisbt-xss/A stored HTML injection vulnerability (CVE-2026-33548) exists in MantisBT version 2.28.0, allowing attackers to inject HTML and execute arbitrary JavaScript by manipulating tag names displayed in the timeline due to improper escaping.A stored cross-site scripting (XSS) vulnerability has been identified in MantisBT version 2.28.0. This flaw, tracked as CVE-2026-33548, stems from the improper handling of tag names retrieved from the history when displaying them in the timeline (my_view_page.php). Specifically, the application fails to adequately escape HTML entities within the tag names, allowing an attacker to inject malicious HTML code. If Content Security Policy (CSP) settings are permissive, this injected HTML can be leveraged to execute arbitrary JavaScript code within the context of a user's browser. This can lead to session hijacking, defacement, or other malicious activities. The vulnerability was discovered and responsibly reported by Vishal Shukla. Defenders should upgrade or implement workarounds.

Attack Chain

1. An attacker with appropriate privileges logs into a vulnerable MantisBT instance.
2. The attacker creates a new tag with a malicious payload embedded in the tag name (e.g., <img src=x onerror=alert(1)>).
3. The attacker associates the malicious tag with an issue.
4. The attacker renames the malicious tag, further storing the payload in the history.
5. A user views the issue's timeline on my_view_page.php.
6. The application retrieves the tag name from the history without proper escaping.
7. The malicious HTML is rendered in the user's browser.
8. If CSP allows, the injected JavaScript executes, leading to XSS.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other MantisBT users' browsers. This can lead to sensitive information disclosure, such as session cookies, which can then be used to hijack user accounts. The impact could also include defacement of the MantisBT interface or redirection of users to malicious websites. The vulnerability affects MantisBT 2.28.0 and requires immediate patching or mitigation.

Recommendation

• Upgrade to a patched version of MantisBT that includes the fix f32787c14d4518476fe7f05f992dbfe6eaccd815.
• Apply the suggested workaround by wrapping $this->tag_name in a string_html_specialchars() call in IssueTagTimelineEvent::html().
• Deploy the Sigma rule "MantisBT Tag Based XSS Attempt" to detect potential exploitation attempts within web server logs.
• Monitor web server logs for requests to my_view_page.php containing suspicious tag names with HTML entities as detected by the Sigma rule "MantisBT Suspicious Tag".

]]>highadvisorymantisbtxsshtml-injectioncve-2026-33548webserverhttps://feed.craftedsignal.io/briefs/2024-01-mantisbt-auth-bypass/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-mantisbt-auth-bypass/MantisBT instances running on MySQL are vulnerable to an authentication bypass in the SOAP API due to improper type checking on the password parameter, allowing attackers with a valid username to log in without the actual password.MantisBT, a widely used web-based bug tracking system, is susceptible to a critical authentication bypass vulnerability (CVE-2026-30849) affecting instances utilizing MySQL or compatible databases. This flaw stems from inadequate type checking on the password parameter within the SOAP API. Specifically, the vulnerability exists in MantisBT versions prior to 2.28.1. An attacker who knows a valid username can exploit this weakness to gain unauthorized access to the SOAP API, circumventing the need for the correct password. Other database backends are not affected due to their stricter type handling. Successful exploitation grants the attacker the ability to execute any API function accessible to the compromised user, posing a significant risk of data breaches, system compromise, and unauthorized modifications.

Attack Chain

1. Attacker identifies a vulnerable MantisBT instance running on MySQL or a compatible database.
2. Attacker obtains a valid username for the MantisBT instance (e.g., through OSINT or social engineering).
3. Attacker crafts a malicious SOAP envelope containing the target username and a manipulated password parameter designed to exploit the type checking vulnerability.
4. Attacker sends the crafted SOAP request to the MantisBT instance's SOAP API endpoint.
5. The vulnerable MantisBT instance improperly processes the password parameter due to insufficient type validation.
6. The MantisBT instance authenticates the attacker as the targeted user without requiring the correct password.
7. Attacker leverages the authenticated SOAP API session to execute privileged API functions.
8. Attacker exfiltrates sensitive bug data, modifies bug reports, or performs other malicious actions within the MantisBT system.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to a MantisBT instance. The impact includes potential data breaches involving sensitive bug reports, project information, and user data. Attackers can modify or delete bug reports, disrupt project workflows, or escalate their access to other systems connected to the MantisBT instance. While the exact number of affected MantisBT installations is unknown, the widespread use of MantisBT across various sectors suggests a potentially broad impact. Disabling the SOAP API mitigates the risk, but still allows the attacker to retrieve user account information including email address and real name.

Recommendation

• Upgrade MantisBT to version 2.28.1 or later to patch CVE-2026-30849 and remediate the authentication bypass vulnerability.
• If upgrading is not immediately feasible, disable the SOAP API as a workaround, referencing the MantisBT documentation .
• Monitor web server logs for suspicious SOAP API requests containing unusual password parameters indicative of exploitation attempts. Deploy a webserver rule to detect unusual password parameters in SOAP API requests.

]]>criticaladvisorymantisbtauthentication-bypasssoap-api