Most recent entries from all

EUVD-2026-322791

fkie_cve-2026-44657

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2.

GHSA-p6fr-rxq7-xcg8 — MantisBT Vulnerable to Stored XSS in File Download

Affected: Packagist: mantisbt/mantisbt

Using *show_inline=1* parameter and a valid *file_show_inline_token* CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

### Impact Cross-site scripting

### Patches - 26647b2e68ba30b9d7987d4e03d7a16416684bc2

### Workarounds None

### Credits Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.