| Summary | Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_token CSRF token on file_download.php, an attacker can execute code by uploading a crafted XHTML attachment referencing a JavaScript attachment. This vulnerability is fixed in 2.28.2. |
|---|---|
| Publication Date | May 29, 2026, 6:16 a.m. |
| Registration Date | May 30, 2026, 4:11 a.m. |
| Last Update | May 30, 2026, 12:11 a.m. |