GitHub Advisoryadvisory · Packagist

GHSA-xjmx-cprh-646r MantisBT unauthorized users able to access private files

MEDIUM Published 2022-05-24 Modified 2025-05-29 Official page ↗
Aliases
CVE-2020-25781
Ecosystem
Packagist
Packages
mantisbt/mantisbt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-863
Reviewed
2025-05-29

Affected packages

• Packagist mantisbt/mantisbt: < 2.24.3 → fixed in 2.24.3

Description

An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.

Related

Alias · CVE (1)

  • CVE-2020-25781 An issue was discovered in file_download.php in MantisBT before 2.24.3. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References