4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34754

CVE-2026-34754: MantisBT allows unauthorized users to upload attachments to restricted issues via REST API

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34754

CVE-2026-34754:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mantisbt/mantisbt	composer	<= 2.28.1	2.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch b262b4d2835b81394d75356dead66e52a6275206 reveals that the vulnerability is located in the file_allow_bug_upload function within core/file_api.php. The vulnerability is an authorization bypass where the application fails to properly check if a user has access to a specific bug before allowing an attachment upload. The original code only verified if the user had permission to upload files at the project level, using access_has_project_level(). This created a security hole where a user could upload attachments to private bugs they could not otherwise access. The patch introduces a more granular check. It now first determines if the upload is for an existing bug (by checking if $p_bug_id is not null). If it is, the function access_has_bug_level() is called to ensure the user has the necessary permissions for that specific bug. If it's a new bug, the original project-level check remains. This change directly addresses the reported vulnerability.

Vulnerable functions

file_allow_bug_upload

core/file_api.php

The vulnerability exists in the `file_allow_bug_upload` function, which is responsible for checking if a user has permission to upload a file to a bug. Before the patch, the function only checked for project-level permissions, even when uploading a file to an existing, private bug. This allowed an attacker with project-level access to upload attachments to any bug within that project, including private ones they were not authorized to view. The patch rectifies this by adding a specific check for bug-level permissions when a bug ID is provided.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.