{"action":"Upgrade mantisbt/mantisbt to 2.28.4 or later.","affected":[{"fixed":"2.28.4","introduced":"1.3.0"}],"component":"mantisbt/mantisbt","cve_ids":["CVE-2026-49273"],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.28.4"],"ghsa_id":"GHSA-v84x-qvhg-f36r","id":"tcs_01M5KF8YQCPKDCBB92RAYP9P79","modified_at":"2026-07-15T17:11:43.450788Z","published_at":"2026-07-15T16:52:24Z","references":["https://osv.dev/vulnerability/GHSA-v84x-qvhg-f36r","https://github.com/mantisbt/mantisbt/security/advisories/GHSA-v84x-qvhg-f36r","https://github.com/mantisbt/mantisbt/commit/78c0af63d1fe0118004744cab21ca3bf2cea0f5c","https://github.com/mantisbt/mantisbt","https://mantisbt.org/bugs/view.php?id=37122"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-v84x-qvhg-f36r","url":"https://osv.dev/vulnerability/GHSA-v84x-qvhg-f36r"}],"summary":"MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php"}