Input Validation Flaw in Mantis Bug Tracker Allows Log Corruption

CVE-2025-46556

What is CVE-2025-46556?

Mantis Bug Tracker, a prominent open-source issue tracking tool, suffers from an input validation issue that allows malicious users to permanently corrupt issue activity logs. By submitting excessively long notes—tested with up to 4,788,761 characters—users can exploit the absence of server-side verification for input length, resulting in the failure of the activity stream UI to render. This prevents the display of subsequent notes, effectively hindering all collaboration on the affected issues. The issue has been resolved in version 2.27.2, emphasizing the importance of updating to enhance system security.

References