{"id":"CVE-2026-49273","aliases":["GHSA-v84x-qvhg-f36r"],"title":"MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php","summary":"MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php","severity":"high","cwe":["CWE-95"],"vendor":"mantisbt","product":"mantisbt/mantisbt","ecosystem":"composer","affected":["mantisbt/mantisbt >= 1.3.0, <= 2.28.3"],"patched":["mantisbt/mantisbt 2.28.4"],"published":"2026-07-15","updated":"2026-07-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-v84x-qvhg-f36r","references":[{"url":"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v84x-qvhg-f36r"},{"url":"https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c"},{"url":"https://mantisbt.org/bugs/view.php?id=37122"},{"url":"https://github.com/advisories/GHSA-v84x-qvhg-f36r"}],"tags":["ghsa","composer"],"ingestedAt":"2026-07-15T17:44:34.628Z","slug":"CVE-2026-49273","body":"## Overview\n\nMantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin \"Manage Configuration\" feature (adm_config_set.php). When setting a configuration value with a non-string type (integer, float, complex), the value is passed through ConfigParser -> Tokenizer, which calls *eval()* with a `return;` prefix intended to prevent code execution.\n\nHowever, PHP hoists function and class declarations at compile time, even past a *return* statement. An attacker can define a class in the eval()'d code that hijacks a class loaded later via PHP's autoloader, achieving arbitrary code execution.\n\nThis vulnerability requires administrator access to the web UI (adm_config_set.php). The REST API's ConfigsSetCommand does NOT use Tokenizer/eval() and is not affected.\n\n### Impact\n- Remote code execution as the web server user (www-data) from an authenticated administrator session\n\n### Patches\n- https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c\n\n### Workarounds\nNone. \n\n### Resources\n- https://mantisbt.org/bugs/view.php?id=37122\n\n### Credits\nMcCaulay Hudson (@_McCaulay) of watchTowr\n\n## Affected packages\n\n- `mantisbt/mantisbt >= 1.3.0, <= 2.28.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mantisbt/mantisbt 2.28.4`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}