Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2.

The version of MantisBT installed on the remote host is prior to 2.28.2. It is, therefore, affected by multiple vulnerabilities:

  - MantisBT is vulnerable to Privilege Escalation from Manager to Administrator. (CVE-2026-34390)

  - MantisBT is vulnerable to Authorization Bypass in Bugnote Editing via Issue Update API. (CVE-2026-42070)

  - MantisBT is vulnerable to Stored XSS in Custom Field Textarea Values. (CVE-2026-39960)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1
    parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code
    by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed
    in 2.28.2. (CVE-2026-44657)

ID	Name	Product	Family	Severity
315202	MantisBT < 2.28.2 Multiple Vulnerabilities	Nessus	CGI abuses : XSS	high
441738	SCA: security update for mantisbt/mantisbt (GHSA-p6fr-rxq7-xcg8)	Tenable Cloud Security	SCA Checks	high
441738	SCA: security update for mantisbt/mantisbt (GHSA-p6fr-rxq7-xcg8)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-44657

high

Tenable Plugins

high

high

high