Cloudanix VulnDB

CVE-2026-40597

High · 8.3

MantisBT has a Content Security Policy bypass via attachments

CVSS

8.3

EPSS

0.6%

Published

May 11, 2026

CISA due date

—

The record

Given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's _script-src_ directive by uploading a crafted attachment to any issue that, when accessed via the _file_download.php_ link, will be downloaded with a valid JavaScript MIME type resulting in script execution. The uploaded payload must be sniffed as a valid JavaScript MIME type by PHP finfo (see file_create_finfo() API function). Non-JavaScript MIME types will not get imported in a `<script>` tag by the browser, due to response header X-Content-Type-Options being set to _nosniff_, which requires all imported JavaScript files to be a valid JavaScript MIME type.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities