CVE-2002-1113: summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP c...

Security readout for executives and security teams

This old Mantis issue could let a remote attacker make the application run attacker-controlled PHP code. That can mean full compromise of the affected web application. The evidence only identifies Mantis 0.17.3 and earlier; it does not show current active exploitation. Exposure is likely limited to legacy Mantis installations at version 0.17.3 or earlier, especially if internet-facing. Modern MantisBT deployments are not identified as affected in the provided evidence. Prioritize if legacy Mantis is still running. Remote code execution against an issue tracker can expose credentials, source discussions, tickets, and internal operational data. If no affected Mantis exists, this is a low-effort documentation and asset-inventory check. Mitigation focus: Identify and retire any Mantis 0.17.3-or-earlier deployments.; Follow Debian or vendor guidance for the appropriate fixed release path.; Remove public exposure until the instance is confirmed unaffected..

Prepared

Jun 30, 2026, 03:57 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.