CVE-2014-7146: Mantisbt

High severity, CVSS 7.5. EPSS: 50.6% chance of exploitation in the next 30 days.

The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.

Affected products

• Mantisbt Mantisbt: version 1.2.17 only

Published 2014-11-18. Last modified 2026-06-17.