PT-2026-39882 · Packagist · Mantisbt/Mantisbt

Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-40597

Positive Technologies (AI Summary)

CVSS v4.0

7.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MantisBT (affected versions not specified)

Description An attacker can bypass the Content Security Policy (CSP) script-src directive by uploading a crafted attachment to an issue. When this attachment is accessed via the 'file download.php' endpoint, it is downloaded with a valid JavaScript MIME type, enabling script execution if a pre-existing XSS or HTML injection vulnerability exists. The payload must be recognized as a valid JavaScript MIME type by the PHP file create finfo() function. Because the X-Content-Type-Options header is set to nosniff, the browser will only import the file into a <script> tag if it possesses a valid JavaScript MIME type.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-79

CWE-358

Related Identifiers

CVE-2026-40597

GHSA-9C3J-XM6V-J7J3

Affected Products

Mantisbt/Mantisbt

References · 6

• https://osv.dev/vulnerability/GHSA-9c3j-xm6v-j7j3 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/9e3bee2e7b909f4e3596985892b8bc8bee9e0bfe · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-9c3j-xm6v-j7j3 · Note
• https://mantisbt.org/bugs/view.php?id=37016 · Note
• https://twitter.com/dailycve/status/2053991079536472240 · Twitter Post