PT-2025-45766 · Packagist · Mantisbt/Mantisbt

Publicado 2025-11-03 · Atualizado 2025-11-03

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:

Impact

• The entire activity stream becomes unviewable (UI fails to render).
• New notes cannot be displayed, effectively breaking all future collaboration on the issue.

Patches

Fixed in 2.27.2.

Workarounds

None

Credits

Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

GHSA-R3JF-HM7Q-QFW5

Produtos afetados

Mantisbt/Mantisbt

Referências · 7

• https://github.com/mantisbt/mantisbt · Nota
• https://github.com/mantisbt/mantisbt/commit/c99a41272532ba49b5c8dccb7797afead9864234 · Nota
• https://github.com/mantisbt/mantisbt/commit/d5cec6bffb44d54bd412c186b9baa409b1aa4238 · Nota
• https://github.com/mantisbt/mantisbt/commit/e9119c68b4a0eaa0bbde3deb121e81f5f7157361 · Nota
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-r3jf-hm7q-qfw5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-46556 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-r3jf-hm7q-qfw5 · Aviso do Fabricante