PT-2025-45766 · Packagist · Mantisbt/Mantisbt

Published 2025-11-03 · Updated 2025-11-03

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A lack of server-side validation for note length in MantisBT allows attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters). Once such a note is added:

Impact

• The entire activity stream becomes unviewable (UI fails to render).
• New notes cannot be displayed, effectively breaking all future collaboration on the issue.

Patches

Fixed in 2.27.2.

Workarounds

None

Credits

Thanks to Mazen Mahmoud (@TheAmazeng) for reporting the vulnerability.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-R3JF-HM7Q-QFW5

Affected Products

Mantisbt/Mantisbt

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-46556 · Security Note
• https://osv.dev/vulnerability/GHSA-r3jf-hm7q-qfw5 · Vendor Advisory
• https://github.com/mantisbt/mantisbt · Note
• https://github.com/mantisbt/mantisbt/commit/c99a41272532ba49b5c8dccb7797afead9864234 · Note
• https://github.com/mantisbt/mantisbt/commit/d5cec6bffb44d54bd412c186b9baa409b1aa4238 · Note
• https://github.com/mantisbt/mantisbt/commit/e9119c68b4a0eaa0bbde3deb121e81f5f7157361 · Note
• https://github.com/mantisbt/mantisbt/security/advisories/GHSA-r3jf-hm7q-qfw5 · Note