XSS in Mantisbt

CVE-2026-44657

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML att…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.001 (22.1th percentile) — read the EPSS interpretation.