File Upload Vulnerability in Mantis Bug Tracker Affects User Privacy

CVE-2026-34754

What is CVE-2026-34754?

Mantis Bug Tracker, an open-source issue tracking system, contains a vulnerability that allows authenticated users to upload attachments to private issues they are not authorized to access. This misconfiguration poses significant privacy risks, allowing sensitive data exposure to unauthorized users. The issue has been resolved in version 2.28.2, and users are advised to update to protect their systems from potential exploitation.

References