# CVE-2026-44657: MantisBT stored XSS in file_download.php via XHTML attachments

Source: https://junglewise.ai/threats/cve-2026-44657-mantisbt-stored-xss-in-file-download-php-via-xhtml-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44657 · Severity: high · CVSS 4 · Published 2026-05-28

MantisBT is a popular open-source bug tracking system. A security vulnerability in the file download component allows an attacker to execute malicious scripts in the context of another user's session. This could lead to the theft of sensitive information, such as login cookies, or unauthorized actions performed on behalf of the victim.

Technologies: [MantisBT Mantis Bug Tracker](https://junglewise.ai/threats/technologies/mantisbt), [mantisbt/mantisbt (Packagist)](https://junglewise.ai/threats/technologies/mantisbt-mantisbt). Vendors: [MantisBT](https://junglewise.ai/threats/vendors/mantisbt), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-44657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44657 being exploited in the wild.

**How severe is CVE-2026-44657?** High severity, with a CVSS score of 4, published 28 May 2026.

**Which products and versions are affected?** MantisBT Mantis Bug Tracker < 2.28.2; MantisBT <= 2.28.1; mantisbt/mantisbt (Packagist) <= 2.28.1, ECOSYSTEM:introduced=0,fixed=2.28.2.

**Is there a fix for CVE-2026-44657?** Yes. mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44657 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44657?** Check whether you run MantisBT Mantis Bug Tracker, MantisBT or mantisbt/mantisbt (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mantisbt/mantisbt (Packagist): upgrade to 2.28.2 or later

  ```sh
  composer require mantisbt/mantisbt:^2.28.2
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in MantisBT's file_download.php component. By utilizing the 'show_inline=1' parameter and providing a valid 'file_show_inline_token' CSRF token, an attacker can bypass standard security controls. The exploit involves uploading a crafted XHTML attachment that references a secondary malicious JavaScript attachment. When a victim views the file inline, the script executes in their browser context. This requires low-privileged authenticated access to upload files and some user interaction to view the attachment. The issue is patched in version 2.28.2.

## Affected products

- MantisBT MantisBT <= 2.28.1

## Identifiers

- CVE-2026-44657
- GHSA-p6fr-rxq7-xcg8

## Timeline

- 2026-05-09: disclosed
- 2026-05-11: advisory: GitHub Advisory published
- 2026-05-28: other: NVD published

## References

- [https://api.github.com/users/siunam321](https://api.github.com/users/siunam321)
- [https://github.com/siunam321](https://github.com/siunam321)
- [https://api.github.com/users/siunam321/gists%7B/gist_id%7D](https://api.github.com/users/siunam321/gists%7B/gist_id%7D)
- [https://api.github.com/users/siunam321/repos](https://api.github.com/users/siunam321/repos)
- [https://avatars.githubusercontent.com/u/104430134?v=4](https://avatars.githubusercontent.com/u/104430134?v=4)
- [https://api.github.com/users/siunam321/events%7B/privacy%7D](https://api.github.com/users/siunam321/events%7B/privacy%7D)

## Related threats

- [MantisBT authentication bypass in SOAP API](https://junglewise.ai/threats/cve-2026-47156-mantisbt-authentication-bypass-in-soap-api)
- [MantisBT stored XSS in print_all_bug_page_word.php](https://junglewise.ai/threats/cve-2026-62944-mantisbt-stored-xss-in-print-all-bug-page-word-php)
- [MantisBT improper input validation in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52883-mantisbt-improper-input-validation-in-rest-and-soap-apis)
- [MantisBT authorization bypass in REST and SOAP APIs](https://junglewise.ai/threats/cve-2026-52882-mantisbt-authorization-bypass-in-rest-and-soap-apis)
- [MantisBT reflected XSS in admin/install.php](https://junglewise.ai/threats/cve-2026-52881-mantisbt-reflected-xss-in-admin-install-php)