Skip to content
Threat Feed
Subscribe

Tag

Class-Hoisting

1 brief RSS
high advisory

MantisBT Remote Code Execution via Class Hoisting (CVE-2026-49273)

A high-severity remote code execution vulnerability, CVE-2026-49273, affects MantisBT versions 2.28.3 and earlier, allowing an authenticated administrator to achieve arbitrary code execution as the web server user by leveraging PHP's class hoisting during the processing of non-string configuration values in `adm_config_set.php`.

MantisBT remote-code-execution web-application php class-hoisting
1r 1t