EIP-2026-109315

PRE-CVE

Mantis Bug Tracker 0.19 - Remote Server-Side Script Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-109315. PoCs published by Jose Antonio.

AI-analyzed exploit summary The vulnerability allows remote script execution in Mantis due to PHP's 'register_globals = on' configuration, enabling attackers to override variables in require() statements via URI manipulation.

Description

Mantis Bug Tracker 0.19 - Remote Server-Side Script Execution

Exploits (1)

exploitdb WRITEUP VERIFIED
by Jose Antonio · textwebappsphp
https://www.exploit-db.com/exploits/24390

The vulnerability allows remote script execution in Mantis due to PHP's 'register_globals = on' configuration, enabling attackers to override variables in require() statements via URI manipulation.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Mantis 0.19.0a
No auth needed
Prerequisites: PHP configured with 'register_globals = on' · Access to the target Mantis instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026