Skip to content
Threat Feed

Vendor

MantisBT

2 briefs RSS
high advisory

MantisBT Private Bugnote Attachment Content Leak via REST API

MantisBT is vulnerable to a missing authorization check in its file visibility function, allowing authenticated users with REPORTER or higher access to download attachments on private bugnotes they should not be able to access through the REST API and SOAP API, affecting versions 2.23.0 to 2.28.1.

mantisbt credential-access authorization-bypass rest-api
2r 1t
high advisory

MantisBT Content Security Policy Bypass via Attachment Upload (CVE-2026-40597)

A content security policy bypass vulnerability, CVE-2026-40597, exists in MantisBT versions 2.28.1 and earlier, allowing an attacker to bypass the _script-src_ directive by uploading a crafted attachment that, when downloaded, executes as JavaScript due to MIME type sniffing, given a pre-existing XSS / HTML injection vulnerability.

mantisbt +1 csp-bypass xss attachment mime-sniffing
2r 1t