Path Traversal in Mantisbt

CVE-2011-3357

Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bug_actiongroup_page.php.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.093 (94.8th percentile) — read the EPSS interpretation.

Affected products

  • Mantisbt — versions 0.19.3, 0.19.4, 1.0.0
  • N/a — versions n/a

Weakness classification (CWE)

References