CVE-2026-44657: MantisBT: Stored XSS in File Download

Synopsis

Stored cross-site scripting (XSS) via crafted file attachment in MantisBT (Mantis Bug Tracker) prior to version 2.28.2. An authenticated attacker can upload a malicious XHTML attachment that references a JavaScript attachment, then trick a victim into opening it via the file_download.php endpoint with the show_inline=1 parameter and a valid CSRF token. Successful exploitation gives the attacker full control over the victim's session in the browser, allowing them to read and modify data as that user. HarborGuard tracks this advisory and will make a patched-image rebuild available once an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the MantisBT instance over the network to upload the crafted attachment and deliver the inline-download link to a victim.

• AuthenticationRequired

  A low-privilege account in MantisBT is sufficient; the attacker only needs enough access to upload file attachments to a project.

• Victim interactionRequired

  A victim must open the malicious inline file link (for example, by clicking an attacker-supplied URL or being directed to the crafted attachment), providing a social-engineering vector.

• Attack complexityDetail

  While the exploit itself is straightforward once the attachment is uploaded, it requires an attacker-triggered pre-condition: possession of a valid file_show_inline_token CSRF token, which introduces an environmental dependency.

Blast Radius

• The attacker's JavaScript runs in the victim's browser session, giving full read access to the victim's MantisBT session token and any data visible in that session.
• The attacker can issue authenticated requests as the victim, modifying issue records, comments, attachments, and project configuration within the victim's permission scope.
• Session hijacking allows the attacker to maintain persistent access to the tracker even after the victim logs out, until the token is invalidated.
• Availability impact is rated low: the exploit does not directly crash the service, but abuse of victim sessions can degrade data integrity across the tracker.