CVE-2019-15715 MantisBT Remote Code Execution

What is CVE-2019-15715?

CVE-2019-15715 is a high-severity command injection vulnerability in Mantisbt Mantisbt, published on 9 Oct 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution.

Weakness: CWE-78

Which versions are affected by CVE-2019-15715?

4 open source packages ship an affected version, including mantisbt/mantisbt. It affects 1 product.

Products include Mantisbt Mantisbt.

How do I fix CVE-2019-15715?

Upgrade mantisbt/mantisbt to a fixed version for your release line: 1.3.20 or 2.22.1.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-15715 being exploited?

There is no known exploitation of CVE-2019-15715 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in Mantisbt Mantisbt

• CVE-2019-15074 MantisBT allows cross-site scripting (XSS) via crafted filename Critical 9.6
• CVE-2026-30849 MantisBT SOAP API has an authentication bypass vulnerability on MySQL Critical 9.3
• CVE-2025-47776 MantisBT: Authentication bypass for some passwords due to PHP type juggling High 8.8
• CVE-2017-7615 MantisBT allows arbitrary password reset High 8.8
• CVE-2026-33517 MantisBT Vulnerable to Stored HTML Injection in Tag Delete Confirmation High 8.6

All Mantisbt Mantisbt vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v23g-wjvq-2fpf.