Which versions of PHP are affected by CVE-2026-49273?

MantisBT versions 1.3.0-2.28.3 contain an authenticated remote code execution vulnerability accessible through the administrative configuration interface, allowing any administrator to execute…. A patch is available.

How to fix or mitigate CVE-2026-49273?

Within 24 hours, identify all MantisBT instances in use and confirm which are running vulnerable versions (1.3.0-2.28.3), then review recent administrative activity logs for unauthorized configuration changes and audit current admin account access controls. Within 7 days, upgrade all affected MantisBT installations to version 2.28.4, performing testing in a staging environment prior to production deployment and verifying successful patch application. Within 30 days, conduct a comprehensive security audit of administrative accounts and credentials, rotate any admin passwords as a precaution, and implement enhanced monitoring and alerting on the Manage Configuration administrative page for unauthorized access attempts.

PHP CVE-2026-49273

HIGH

Eval Injection (CWE-95)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-v84x-qvhg-f36r

PHP RCE Code Injection

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 17:17 vuln.today

Analysis Generated

Jul 15, 2026 - 17:17 vuln.today

CVE Published

Jul 15, 2026 - 16:52 cve.org

HIGH

DescriptionCVE.org

MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature (adm_config_set.php). When setting a configuration value with a non-string type (integer, float, complex), the value is passed through ConfigParser -> Tokenizer, which calls *eval()* with a return; prefix intended to prevent code execution.

However, PHP hoists function and class declarations at compile time, even past a *return* statement. An attacker can define a class in the eval()'d code that hijacks a class loaded later via PHP's autoloader, achieving arbitrary code execution.

This vulnerability requires administrator access to the web UI (adm_config_set.php). The REST API's ConfigsSetCommand does NOT use Tokenizer/eval() and is not affected.

Impact

Remote code execution as the web server user (www-data) from an authenticated administrator session

Patches

https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c

Workarounds

None.

Resources

https://mantisbt.org/bugs/view.php?id=37122

Credits

McCaulay Hudson (@_McCaulay) of watchTowr

AnalysisAI

Authenticated remote code execution in MantisBT versions 1.3.0 through 2.28.3 allows an administrator to run arbitrary PHP as the web server user (www-data) via the 'Manage Configuration' page (adm_config_set.php). When a config value is stored with a non-string type, the ConfigParser/Tokenizer path calls eval() on attacker-controlled code guarded only by a 'return;' prefix; because PHP hoists class and function declarations at compile time regardless of the return, an attacker can plant a class that later hijacks the autoloader. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the flaw was reported privately by watchTowr and fixed in 2.28.4.