CVE-2026-34754

MEDIUM

MantisBT allows unauthorized users to upload attachments to restricted issues via REST API

Title source: cna
STIX 2.1

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

References (3)

Core 3

Scores

CVSS v3 4.3
EPSS 0.0025
EPSS Percentile 15.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (2)
mantisbt/mantisbt 0 - 2.28.2Packagist
mantisbt/mantisbt < 2.28.2
Published May 20, 2026
Tracked Since May 20, 2026