SQL Injection Affecting mantisbt/mantisbt package, versions <2.28.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-MANTISBTMANTISBT-17984478
- published15 Jul 2026
- disclosed15 Jul 2026
- creditUnknown
Introduced: 15 Jul 2026
CVE-2026-47142 (opens in a new tab)How to fix?
Upgrade mantisbt/mantisbt to version 2.28.4 or higher.
Overview
mantisbt/mantisbt is a mantis bug tracker.
Affected versions of this package are vulnerable to SQL Injection via the history_order configuration value in the history_api.php process. An attacker can execute arbitrary SQL commands by injecting malicious input into the configuration, which is then concatenated into a SQL ORDER BY clause without sanitization or validation. This allows extraction of sensitive data from the database, including user credentials, API tokens, and private issue data. If the database user has the MySQL FILE privilege, it is possible to achieve remote code execution by writing a PHP webshell to the web root. The payload can be planted by an administrator and triggered by any authenticated user viewing a bug with history entries.