Executive brief
MantisBT is a popular open-source bug tracking system. A security vulnerability in the file download component allows an attacker to execute malicious scripts in the context of another user's session. This could lead to the theft of sensitive information, such as login cookies, or unauthorized actions performed on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in MantisBT's file_download.php component. By utilizing the 'show_inline=1' parameter and providing a valid 'file_show_inline_token' CSRF token, an attacker can bypass standard security controls. The exploit involves uploading a crafted XHTML attachment that references a secondary malicious JavaScript attachment. When a victim views the file inline, the script executes in their browser context. This requires low-privileged authenticated access to upload files and some user interaction to view the attachment. The issue is patched in version 2.28.2.
Affected products
- MantisBT MantisBT <= 2.28.1
Timeline
- 2026-05-09: disclosed
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-28: other: NVD published