CVE-2026-40597 mantisbt CVE debrief

Who should care

Users of Mantis Bug Tracker versions 2.28.1 and below should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 2.28.2 or later, restricting file uploads to only allow specific MIME types, and implementing additional security measures such as Content Security Policy and input validation.

Technical summary

The vulnerability in Mantis Bug Tracker versions 2.28.1 and below allows for XSS / HTML injection attacks via crafted attachments. An attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue, which when accessed via the file_download.php link, will be downloaded with a valid JavaScript MIME type resulting in script execution. This occurs because the Content Security Policy's script-src directive can be bypassed when a crafted attachment is uploaded and accessed. The affected product is Mantis Bug Tracker versions 2.28.1 and below. Users should update to version 2.28.2 or later and implement additional security measures such as Content Security Policy and input validation. The vulnerability was reported by an unknown source and has been fixed in version 2.28.2. Evidence is limited, and defenders should verify the affected scope and severity.

Defensive priority

High

Recommended defensive actions

• Update to version 2.28.2 or later
• Restrict file uploads to only allow specific MIME types
• Implement additional security measures such as Content Security Policy and input validation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by an unknown source and has been fixed in version 2.28.2. Evidence is limited, and defenders should verify the affected scope and severity. The Content Security Policy's script-src directive can be bypassed by uploading a crafted attachment to any issue. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo.

Official resources