CVE-2026-34754

4.3 mediumEPSS 0.2%

Medium (4.3). EPSS 0.2% chance of exploitation in the next 30 days.

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2026-05-20
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/mantisbt/mantisbt/commit/b262b4d2835b81394d75356dead66e52a6275206
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h4x5-gvx6-3rwc
https://mantisbt.org/bugs/view.php?id=36976

Check your stack JSON