{"id":"CVE-2026-49273","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-49273","summary":"MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php","details":"MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin \"Manage Configuration\" feature (adm_config_set.php). When setting a configuration value with a non-string type (integer, float, complex), the value is passed through ConfigParser -> Tokenizer, which calls *eval()* with a `return;` prefix intended to prevent code execution.\n\nHowever, PHP hoists function and class declarations at compile time, even past a *return* statement. An attacker can define a class in the eval()'d code that hijacks a class loaded later via PHP's autoloader, achieving arbitrary code execution.\n\nThis vulnerability requires administrator access to the web UI (adm_config_set.php). The REST API's ConfigsSetCommand does NOT use Tokenizer/eval() and is not affected.\n\n### Impact\n- Remote code execution as the web server user (www-data) from an authenticated administrator session\n\n### Patches\n- https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c\n\n### Workarounds\nNone. \n\n### Resources\n- https://mantisbt.org/bugs/view.php?id=37122\n\n### Credits\nMcCaulay Hudson (@_McCaulay) of watchTowr","published":"2026-07-15T16:52:24Z","modified":"2026-07-15T17:11:43.450788Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"mantisbt/mantisbt","fixedVersion":"2.28.4"}],"fix":{"url":"https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c","label":"mantisbt/mantisbt@78c0af6"},"references":[{"type":"WEB","url":"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v84x-qvhg-f36r"},{"type":"WEB","url":"https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c"},{"type":"PACKAGE","url":"https://github.com/mantisbt/mantisbt"},{"type":"WEB","url":"https://mantisbt.org/bugs/view.php?id=37122"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-15T17:11:43.450788Z"}}