Medium severity4.3GHSA Advisory· Published May 20, 2026· Updated May 20, 2026

CVE-2026-34754

Description

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mantisbt/mantisbtPackagist	< 2.28.2	2.28.2

Affected products

Mantisbt/MantisbtGHSA
Range: <= 2.28.1
ghsa-coords
pkg:composer/mantisbt/mantisbt
Range: < 2.28.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-h4x5-gvx6-3rwcghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-34754ghsaADVISORY
github.com/mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206nvdWEB
github.com/mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwcnvdWEB
mantisbt.org/bugs/view.phpnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000