7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44657

CVE-2026-44657: MantisBT Vulnerable to Stored XSS in File Download

Using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment.

Impact

Cross-site scripting

Patches

26647b2e68ba30b9d7987d4e03d7a16416684bc2

Workarounds

None

Credits

Thanks to siunam (Tang Cheuk Hei) for discovering and responsibly reporting the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44657

CVE-2026-44657:

7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	<= 2.28.1	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch (commit 26647b2e68ba30b9d7987d4e03d7a16416684bc2) reveals that the vulnerability lies within the file_download.php script. The commit message explicitly states, "Until now, file_download.php was sending attachments content with a MIME type determined by PHP's Fileinfo... This creates a risk of JavaScript execution bypassing the Content Security Policy." The code changes in the patch confirm this. The logic for setting the Content-Type header was altered to restrict how files are served. Specifically, the patch ensures that text-based files are served as text/plain and other potentially executable types are served as application/octet-stream, forcing a download rather than inline rendering and execution. Since the vulnerable code is not within a defined function but is part of the main script execution flow of file_download.php, the script itself is identified as the vulnerable component that would appear in a runtime profile when the vulnerability is triggered.

Vulnerable functions

file_download.php

file_download.php

The vulnerability exists in the `file_download.php` script, which does not properly sanitize the MIME type of downloaded files. Before the patch, the script would set the `Content-Type` header based on the file's detected MIME type. This allowed an attacker to upload a crafted file (e.g., an XHTML file referencing a JavaScript file) that would be served with a content type that causes the browser to execute it, leading to a stored cross-site scripting (XSS) vulnerability. The patch mitigates this by forcing the `Content-Type` to a safe value like 'text/plain' or 'application/octet-stream' for most file types, preventing their execution in the browser.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.