Executive brief
MantisBT, a popular open-source bug tracking system, contains a vulnerability in its configuration management feature. An authenticated administrator can execute malicious code on the server by exploiting how the system processes certain configuration values. This could lead to a full takeover of the web server, potentially exposing sensitive bug reports and customer data.
Technical details
MantisBT 2.28.3 and earlier is vulnerable to remote code execution via eval() injection in adm_config_set.php. When a non-string configuration value is set, it is processed by ConfigParser and Tokenizer, which executes eval() on the input. Although a 'return;' statement is prepended to prevent execution, PHP's compile-time hoisting allows an attacker to define a class or function within the eval'd string. This defined class can hijack a class intended to be loaded later by the PHP autoloader. Exploitation requires administrative privileges and allows execution of arbitrary code as the web server user. The issue is patched in version 2.28.4.
Affected products
- MantisBT MantisBT >= 1.3.0, <= 2.28.3
Timeline
- 2026-07-15: disclosed
- 2026-07-15: advisory
- 2026-07-15: patched