Vulnerability record · CVE-2014-7146 · published 18 November 2014
CVE-2014-7146: MantisBT XmlImportExport plugin PHP code execution via crafted XML
Mantisbt · Mantisbt
The XmlImportExport plugin in MantisBT 1.2.17 and earlier passes attacker-controlled XML content, specifically the description field and issuelink attribute, into preg_replace with the e modifier, which evaluates the replacement as PHP code. This allows remote code execution on the server hosting the affected MantisBT instance.
Description
The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the preg_replace function with the e modifier.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with a high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.
What it is
The XmlImportExport plugin in MantisBT 1.2.17 and earlier passes attacker-controlled XML content, specifically the description field and issuelink attribute, into preg_replace with the e modifier, which evaluates the replacement as PHP code. This allows remote code execution on the server hosting the affected MantisBT instance.
Impact
An attacker can execute arbitrary PHP code with the privileges of the web server, leading to full compromise of the MantisBT application and potentially the underlying host.
Attack surface
The flaw is reachable over the network through the XML import/export functionality; the CVSS vector AV:N/AC:L/Au:N indicates no authentication or user interaction is required, though the plugin must be enabled and reachable.
Exploitation
No CISA KEV listing and no reference tags indicating public exploit code; EPSS probability is 0.50561 (98.86th percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Upgrade MantisBT to a version after 1.2.17 that removes the preg_replace e modifier usage, per the vendor commits 84017535 and bed19db9.
- If immediate upgrade is not possible, disable or remove the XmlImportExport plugin.
- Restrict network access to the MantisBT import/export endpoints to trusted users or internal networks.
- Apply the Debian security update DSA-3120 if running the Debian package.
- Review web server logs for XML import requests containing PHP code patterns.
Detection
- Search HTTP request logs for POSTs to XmlImportExport or import endpoints with XML bodies containing preg_replace-style payloads or PHP tags.
- Monitor for unexpected PHP file creation or execution in the MantisBT web directory.
- Alert on outbound connections or process spawns from the web server user following XML import activity.
- Audit MantisBT plugin configuration to confirm XmlImportExport is disabled where not needed.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-7146 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-7146), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
