MantisBT flaw lets a rogue admin steal all data

Published July 15, 2026 CVE-2026-47142

MantisBT is a bug-tracking tool used by teams to log and manage software issues. A flaw in versions 2.28.3 and older lets an attacker with admin access trick the system into leaking all stored data, including private project details, user info, and bug reports.

Severity
Not scoredNo CVSS score recorded
Fix
Fixed in 2.28.4
Affected versions
2.28.3 or older
Weakness
CWE-89
Affects
MantisBT

How it works

An attacker with admin access sends a specially crafted request to the historyorder setting in MantisBT, tricking the system into running unauthorized database commands that dump all stored data.

What to do

Check the installed mantisbt/mantisbt version. This advisory applies to 2.28.3 or older.

Update mantisbt/mantisbt to 2.28.4 or newer. Then verify the installed version.

Technical details

CVE-2026-47142 is a SQL injection in MantisBT's core/history_api.php. The history_order configuration value, settable via adm_config_set.php or the REST API's PATCH /api/rest/config, is concatenated directly into a SQL ORDER BY clause with no parameterization or whitelist check. Any authenticated user who views a bug's history then triggers the injected SQL, exposing cookie_string and password hash fields, API tokens, and private issue data across the whole database.

If the MySQL account also holds FILE privilege, the same injection can write a PHP webshell into the web root via INTO OUTFILE, achieving remote code execution. Fixed in MantisBT 2.28.4; credited to McCaulay Hudson of watchTowr.

References

View Original Source