CVE-2014-9271: Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authe...

Security readout for executives and security teams

CVE-2014-9271 is a stored or reflected web scripting risk in MantisBT attachment handling. An authenticated user could upload a specially named Flash file disguised with an image extension, causing script or HTML to run when handled inline. The main business risk is compromise of user sessions or data visible inside the issue tracker. Exposure is most likely where an organization still runs MantisBT before 1.2.18 and allows authenticated users to upload or view inline attachments. Internet-facing trackers raise concern, but authentication is required according to the CVE description. Treat this as a targeted application hygiene issue, not an emergency internet-wide vulnerability. Prioritize remediation for externally reachable or multi-user MantisBT systems, especially where many authenticated users can upload attachments. Mitigation focus: Upgrade MantisBT to 1.2.18 or a vendor-supported fixed package.; Check Debian DSA-3120 if using Debian-packaged MantisBT.; Review vendor guidance for any additional attachment-handling controls..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.