CVE-2026-47142: MantisBT: SQL Injection via history_order Configuration Value

July 15, 2026

MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history_api.php. The history_order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist.

An administrator can set this configuration value via the web UI (adm_config_set.php) or the REST API (PATCH /api/rest/config). The injected SQL then executes whenever any user views a bug with history entries.

References

github.com/advisories/GHSA-mw6p-33vw-46cc
github.com/mantisbt/mantisbt/commit/6ad20bea2e01f33c6e4170775ae4d9dbe2c75325
github.com/mantisbt/mantisbt/security/advisories/GHSA-mw6p-33vw-46cc
mantisbt.org/bugs/view.php?id=37123
nvd.nist.gov/vuln/detail/CVE-2026-47142

Code Behaviors & Features

Detect and mitigate CVE-2026-47142 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →