CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2025-46556

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.27.1 and below allow attackers to permanently corrupt issue activity logs by submitting extremely long notes (tested with 4,788,761 characters) due to a lack of server-side validation of note length. Once such a note is added, the activity stream UI fails to render; therefore, new notes cannot be displayed, effectively breaking all future collaboration on the issue. This issue is fixed in version 2.27.2.

Score
6.5 medium
Published
2025-11-04
Links
NVD · cve.org

Affected ports (5)

PortPackageVersionStatusMaintainer
databases/mantismantis-php822.26.0,1unaddressedzab@zltech.eu
databases/mantismantis-php832.26.0,1unaddressedzab@zltech.eu
databases/mantismantis-php842.26.0,1unaddressedzab@zltech.eu
databases/mantismantis-php852.26.0,1unaddressedzab@zltech.eu
databases/mantismantis-php862.26.0,1unaddressedzab@zltech.eu

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>mantis-php82</name>
	<range><lt>2.27.2</lt></range>
      </package>
      <package>
	<name>mantis-php83</name>
	<range><lt>2.27.2</lt></range>
      </package>
      <package>
	<name>mantis-php84</name>
	<range><lt>2.27.2</lt></range>
      </package>
      <package>
	<name>mantis-php85</name>
	<range><lt>2.27.2</lt></range>
      </package>
      <package>
	<name>mantis-php86</name>
	<range><lt>2.27.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mantis Bug Tracker (MantisBT) is an open source issue tracker.
	Versions 2.27.1 and below allow attackers to permanently corrupt issue
	activity logs by submitting extremely long notes (tested with
	4,788,761 characters) due to a lack of server-side validation of note
	length. Once such a note is added, the activity stream UI fails to
	render; therefore, new notes cannot be displayed, effectively breaking
	all future collaboration on the issue. This issue is fixed in version
	2.27.2.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-46556</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-46556</url>
    </references>
    <dates>
      <discovery>2025-11-04</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>