GHSA-p6fr-rxq7-xcg8

MantisBT Vulnerable to Stored XSS in File Download

Source: GitHub Advisory Database (reviewed) High CVE-2026-44657

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	mantisbt/mantisbt	< 2.28.2	2.28.2

Details

As written in the advisory (Markdown source, shown as plain text).

Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. ### Impact Cross-site scripting ### Patches - 26647b2e68ba30b9d7987d4e03d7a16416684bc2 ### Workarounds None ### Credits Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

References

External links from the advisory. They lead to third-party sites.

https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3 web
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-p6fr-rxq7-xcg8 web
https://nvd.nist.gov/vuln/detail/CVE-2026-44657 advisory
https://github.com/mantisbt/mantisbt/commit/26647b2e68ba30b9d7987d4e03d7a16416684bc2 web
https://github.com/mantisbt/mantisbt package
https://mantisbt.org/bugs/view.php?id=37020 web