CVE-2026-49273: MantisBT Remote Code Execution via eval() Class Hoisting Vulnerability
Summary
CVE-2026-49273: MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php. Affects mantisbt/mantisbt versions >= 1.3.0, < 2.28.4. Fixed in 2.28.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MantisBT is an open-source bug tracking system that provides a user-friendly interface for managing software development projects. It allows users to report bugs, track issues, and manage project workflows efficiently. However, versions 2.28.3 and earlier are susceptible to a critical vulnerability that could allow an attacker to execute arbitrary code through improper handling of configuration values.
Vulnerability Detail
The vulnerability arises in the admin 'Manage Configuration' feature (adm_config_set.php) of MantisBT. When an administrator sets a configuration value with a non-string type, the value is processed through a ConfigParser and Tokenizer, which invokes eval() with a 'return;' prefix. This prefix is intended to prevent code execution, but due to PHP's behavior of hoisting function and class declarations, an attacker can define a class in the eval()'d code. This class can then hijack a class loaded later via PHP's autoloader, leading to remote code execution as the web server user (www-data). This vulnerability requires authenticated administrator access to exploit.
How To Fix
Minimum fixed version
2.28.4
This is the first release that contains the fix.
composer require mantisbt/mantisbt:2.28.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The MantisBT vulnerability CVE-2026-49273 poses a significant risk of remote code execution for installations prior to version 2.28.4. Administrators are strongly advised to update their systems to the latest version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for mantisbt/mantisbt →
FAQ
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
Any MantisBT installation running version 2.28.3 or earlier is affected, particularly those with administrator access.
Yes, an attacker with administrator access can exploit this vulnerability remotely to execute arbitrary code.
Yes, the vulnerability has been patched in version 2.28.4 of MantisBT. Users should update to this version or later.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the composer.lock file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for mantisbt/mantisbt.
