CVE-2026-40597 MantisBT has a Content Security Policy bypass via attachments
Attackers can bypass Content Security Policy restrictions by uploading crafted attachments with valid JavaScript MIME types, enabling script execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40597?
CVE-2026-40597 is a high-severity vulnerability in mantisbt, published on 22 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading a crafted attachment to any issue that, when accessed via the file_download.php link, will be downloaded with a valid JavaScript MIME type resulting in script execution. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a <script> tag by the browser, due to response header X-Content-Type-Options being set to nosniff, which requires all imported JavaScript files to be a valid JavaScript MIME type. This issue has been fixed in version 2.28.2.
Which versions are affected by CVE-2026-40597?
2 open source packages ship an affected version, including mantisbt/mantisbt.
| Package | Affected | Fixed in |
|---|---|---|
mantisbt/mantisbt Packagist | All versions | 2.28.2 |
mantisbt/mantisbt Packagist | All versions | 2.28.2 |
How do I fix CVE-2026-40597?
Upgrade mantisbt/mantisbt to 2.28.2 or later.
Is CVE-2026-40597 being exploited?
There is no known exploitation of CVE-2026-40597 in the wild and no public exploit code.
Sources
Also known as GHSA-9c3j-xm6v-j7j3.