MantisBT CSP Bypass via Malicious File Upload (CVE-2026-40597)

Vulnerability Overview Vulnerability ID: 0037016 Project Name: mantisbt Category: security Status: public Submission Date: 2026-04-12 07:09 Last Updated: 2026-05-09 19:56 Reporter: slunam Priority: immediate Severity: major Resolution: fixed Reproducibility: always Target Version: 2.28.2 Fixed Version: 2.28.2 Impact This vulnerability allows attackers to bypass the directive of the Content Security Policy (CSP) by uploading specially crafted attachments, enabling the execution of arbitrary JavaScript code in the browser. When accessing a link, if the uploaded attachment is recognized as a valid JavaScript MIME type, it leads to script execution. Fix Restrict the header on line 215 of to allow only text/plain, text/html, application/octet-stream, and image MIME types (e.g., image/png). This reduces the risk of CSP bypass attacks through this endpoint. POC Code Steps to Reproduce 1. Create a JavaScript payload, such as : 2. Upload the file as an attachment to any issue accessible to the victim. 3. Obtain the download URL for the file, e.g., . 4. Exploit any existing HTML injection vulnerability, such as the font family in 0039049. - Use a specially crafted POST request (as described in 0039049), or as an administrator, set via to: - Log in as the victim. - The script executes, as shown in the attached screenshot. Additional Information This vulnerability was initially reported as part of 0039049, submitted by slunam. After analysis and discussion, it was determined to be a separate vulnerability. The recommended fix is to restrict the header on line 215 of to allow only text/plain, text/html, application/octet-stream, and image MIME types (e.g., image/png). This is because other MIME types are not truly useful and would reduce the risk of CSP bypass attacks through this endpoint. Relations Related to 0037011: CVE-2026-40599: XSS leading to account takeover via updating user font preferences. Related to 0037020: CVE-2026-44657: Stored XSS in file download. Activity 2026-04-12 13:45: dregal created a CVE request. 2026-04-13 00:40: slunam suggested the CVSS score should be 5. 2026-04-13 01:03: slunam clarified that this CSP bypass is not a vulnerability but a security risk. 2026-04-13 04:30: dregal agreed that this CSP bypass is not a vulnerability but a security risk. 2026-04-13 06:30: slunam argued that this CSP bypass is always a security risk as it removes a layer of protection. 2026-04-17 02:47: dregal assigned CVE-2026-40597. 2026-05-03 13:50: dregal provided a patch for review. 2026-05-07 01:30: slunam confirmed the patch fixes the vulnerability. Related Changesets MantisBT: master-2.28 26647b2e Restrict MIME types for file downloads. Now only sets the header to known safe types (e.g., PDF and images), with all other text forced to text/plain and the rest sent as application/octet-stream. Includes review corrections by vboctor. Fixes 0039049, GHSA-9c3j-xm6v-7j3 / CVE-2026-40597.

Goal Reached Thanks to every supporter — we hit 100%!

MantisBT CSP Bypass via Malicious File Upload (CVE-2026-40597)