CVE-2015-5059: The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_...

Security readout for executives and security teams

CVE-2015-5059 is an information disclosure issue in MantisBT 1.2.19 and earlier. If Project Documentation file access is configured as public through $g_view_proj_doc_threshold=ANYBODY, an authenticated user may download attachments from private projects they should not access. Exposure is limited to MantisBT 1.2.19 or earlier deployments using Project Documentation with file access threshold set to ANYBODY. Systems not using that feature or not using that permissive setting are less likely to be affected based on the provided description. Treat this as a targeted confidentiality risk, not a broad system takeover. Prioritize if MantisBT stores sensitive attachments in private projects, especially customer data, vulnerability reports, incident notes, or regulated information. Mitigation focus: Upgrade MantisBT using vendor or distribution guidance that includes the referenced fixes.; Review $g_view_proj_doc_threshold and avoid ANYBODY for sensitive deployments.; Restrict Project Documentation access to appropriate authenticated project roles..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.