CVE-2026-40597: Mantis Bug Tracker XSS Vulnerability

CVE-2026-40597 Overview

CVE-2026-40597 is a Content Security Policy (CSP) bypass vulnerability in Mantis Bug Tracker (MantisBT), an open source issue tracking application. The flaw affects MantisBT versions 2.28.1 and earlier. An attacker with upload privileges can leverage any pre-existing cross-site scripting (XSS) or HTML injection vulnerability to execute arbitrary JavaScript by uploading a crafted attachment. The file is served by file_download.php with a valid JavaScript MIME type, allowing it to load through a <script> tag despite the script-src directive and X-Content-Type-Options: nosniff header. The issue is classified under [CWE-79] and was fixed in version 2.28.2.

Critical Impact
Authenticated attackers can bypass MantisBT's CSP script-src directive and execute arbitrary JavaScript in the context of other users, enabling session theft and account takeover when chained with an existing HTML injection flaw.

Affected Products

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier
Fixed in MantisBT version 2.28.2
Deployments exposing file_download.php to authenticated users

Discovery Timeline

2026-05-22 - CVE-2026-40597 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-40597

Vulnerability Analysis

MantisBT enforces a Content Security Policy that restricts script sources via the script-src directive. The application also sets X-Content-Type-Options: nosniff to prevent browsers from interpreting non-JavaScript responses as scripts. These controls are designed to limit the impact of HTML injection flaws by blocking inline and remote script execution.

The vulnerability allows an attacker to circumvent both controls. By uploading an attachment whose contents are detected as JavaScript by PHP's finfo extension, the attacker forces file_download.php to return the file with a JavaScript MIME type. The browser then accepts the response as a legitimate script when loaded through a <script src="file_download.php?file_id=..."> tag injected via a separate HTML injection vector.

The attack requires a pre-existing HTML or XSS injection point inside the MantisBT instance. Once chained, the attacker achieves full script execution under the application's origin, defeating the CSP protection that would otherwise contain the injection.

Root Cause

The root cause lies in file_download.php trusting the MIME type produced by the file_create_finfo() API function for uploaded attachments. The download handler does not restrict responses to a safe content type or force a Content-Disposition: attachment for files sniffed as executable script formats. Attachments containing valid JavaScript syntax are therefore returned with a JavaScript MIME type, satisfying the browser's nosniff requirement for <script> imports.

Attack Vector

Exploitation requires an authenticated user with permission to upload attachments to an issue. The attacker uploads a payload crafted to be identified as JavaScript by PHP finfo. The attacker then triggers a secondary HTML injection vulnerability to insert a <script> tag referencing the attachment's file_download.php URL. When a victim views the affected page, the browser fetches the attachment, accepts it as JavaScript, and executes the payload in MantisBT's origin context.

The vulnerability manifests in MantisBT's attachment handling pipeline. See the GitHub Security Advisory and the fix commit for technical details of the patch.

Detection Methods for CVE-2026-40597

Indicators of Compromise

Attachments uploaded to MantisBT issues whose stored content is parsed as JavaScript by PHP finfo rather than the expected document or image types.
HTTP responses from file_download.php returning a JavaScript MIME type (application/javascript, text/javascript) for files attached to bug reports.
<script> tags referencing file_download.php?file_id= URLs appearing in rendered issue pages, summaries, or custom fields.

Detection Strategies

Inspect MantisBT web server access logs for requests to file_download.php that are loaded with a Sec-Fetch-Dest: script request header.
Review uploaded attachment storage for files whose declared extension does not match the MIME type returned by file_download.php.
Correlate attachment upload events with subsequent bug note edits introducing HTML or markup that references the same file_id.

Monitoring Recommendations

Enable verbose access logging on the MantisBT web tier and forward logs to a centralized analytics platform for retrospective hunting.
Alert on outbound script loads from the MantisBT origin to non-static asset paths such as file_download.php.
Track CSP violation reports if report-uri or report-to is configured, focusing on script-src violations originating from internal paths.

How to Mitigate CVE-2026-40597

Immediate Actions Required

Upgrade MantisBT to version 2.28.2 or later, which contains the official fix for CVE-2026-40597.
Audit existing attachments in production instances for files that PHP finfo would classify as JavaScript.
Review the application for any unpatched HTML injection or XSS vectors that could be chained with this bypass.

Patch Information

The MantisBT maintainers released version 2.28.2 with a fix tracked in commit 9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe. The patch adjusts how file_download.php serves uploaded attachments so that they cannot be returned with a JavaScript MIME type. Refer to the GitHub commit and the MantisBT bug report #37016 for the upstream fix details.

Workarounds

Restrict attachment upload privileges to trusted users only until the upgrade to 2.28.2 is completed.
Configure the web server or reverse proxy to force Content-Disposition: attachment on responses from file_download.php.
Deploy a stricter Content Security Policy that disallows loading scripts from the MantisBT application path, limiting script-src to dedicated static asset hosts.

bash

# Configuration example: force attachment download in Apache for file_download.php
<Location "/file_download.php">
    Header always set Content-Disposition "attachment"
    Header always set X-Content-Type-Options "nosniff"
</Location>