SQL injection in MantisBT - CVE-2026-47142
Published: November 6, 2026
Vulnerability identifier: #VU159817
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47142
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to extract sensitive information, including user credentials and private issue data, from the MantisBT database.
The vulnerability exists due to unvalidated concatenation of the history_order configuration value into a SQL ORDER BY clause in the history component. An administrator can plant SQL through the web interface or REST API, causing execution when an authenticated user views an issue with history entries.
Affected software
MantisBT
How to mitigate CVE-2026-47142
Install security update from vendor's website.
MantisBT - update to 2.28.4