MantisBT, an open‑source issue tracker, contains an XSS/HTML injection vulnerability that can be exploited to bypass the Content Security Policy's script‑src directive. An attacker can upload a crafted attachment to any issue; when the file_download.php script serves the attachment, PHP finfo treats it as a valid JavaScript MIME type. The browser, honoring X‑Content‑Type‑Options:nosniff, will embed the file in a <script> tag, allowing arbitrary JavaScript to execute in the victim’s user context. This bypass removes the effectiveness of the CSP and can lead to client‑side code execution and data theft.

The vulnerability affects MantisBT version 2.28.1 and earlier. The issue was addressed in version 2.28.2. All installations running an affected version are at risk until a patch is applied.

With a CVSS score of 7.6, the flaw is considered high severity. Although an EPSS score is not available, the vulnerability can be leveraged by attackers who already have an XSS or HTML injection pathway into the application. By uploading a malicious attachment, they can then trick users into downloading a file that executes JavaScript. The attack does not require any special network-level access and can be performed from any external client with permission to create or modify issues. The flaw is not listed in the CISA KEV catalog.