CVE-2014-8988: MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold an...

Security readout for executives and security teams

Older MantisBT versions let a logged-in user bypass attachment restrictions and read files from private projects. The risk is disclosure of confidential bug reports, customer data, credentials, or design documents stored as attachments. The sources do not show active exploitation. Exposure is limited to organizations running MantisBT before 1.2.18, especially instances with private projects and sensitive file attachments. Anonymous internet users are not described as affected; the attacker must be authenticated. Treat this as a targeted confidentiality risk, not a broad unauthenticated takeover. Prioritize remediation if MantisBT contains sensitive private attachments or is accessible to many external users. Mitigation focus: Upgrade MantisBT to 1.2.18 or a later supported release.; Apply relevant distribution security updates, including Debian DSA-3120 where applicable.; Review MantisBT attachment permissions for private projects..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.