PT-2025-44808 · Unknown · Mantis Bug Tracker

Published 2025-11-03 · Updated 2025-11-05 · CVE-2025-46556

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker versions 2.27.1 and below

Description Mantis Bug Tracker is an open source issue tracker. A lack of server-side validation of note length allows attackers to permanently corrupt issue activity logs by submitting extremely long notes, tested with 4,788,761 characters. Once a note of this length is added, the activity stream user interface fails to render, preventing the display of new notes and disrupting collaboration on the issue.

Recommendations Update to version 2.27.2 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-46556

GHSA-R3JF-HM7Q-QFW5

Affected Products

Mantis Bug Tracker

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46556.json · Exploit
• https://github.com/mantisbt/mantisbt/commit/d5cec6bffb44d54bd412c186b9baa409b1aa4238 · Patch
• https://github.com/mantisbt/mantisbt/commit/e9119c68b4a0eaa0bbde3deb121e81f5f7157361 · Patch
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-r3jf-hm7q-qfw5 · Vendor Advisory
• https://github.com/mantisbt/mantisbt/commit/c99a41272532ba49b5c8dccb7797afead9864234 · Patch
• https://osv.dev/vulnerability/GHSA-r3jf-hm7q-qfw5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46556 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46556 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://reddit.com/r/VulnMatter/comments/1op46de/resumen_diario_de_vulnerabilidades_05112025 · Reddit Post
• https://t.me/cveNotify/141463 · Telegram Post