CVE-2020-25781: An issue was discovered in file_download.php in MantisBT before 2.24.3.

Security readout for executives and security teams

MantisBT before 2.24.3 could expose attachments meant to stay private inside private issue notes. A user who should not see a private note could still retrieve its linked attachment through the file download path. The business risk is unintended disclosure of internal bug evidence, customer data, credentials, or security details stored in those attachments. Exposure is likely limited to MantisBT deployments before 2.24.3 that use private issue notes with attachments. Risk increases where attachment URLs are shared, logged, indexed internally, or discoverable by lower-privileged users. Treat this as a confidentiality issue for bug-tracking data. Prioritize patching if MantisBT stores customer evidence, vulnerability reports, credentials, logs, or legal-sensitive material in private note attachments. Mitigation focus: Upgrade affected MantisBT installations to 2.24.3 or later.; Review MantisBT vendor issue 27039 and linked commits for fix context.; Limit MantisBT access to trusted users until patched..

Prepared

Jun 5, 2026, 14:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.