CVE-2020-25781

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p59

Published

Sep 30, 2020 (Sep 30, 2020)

Modified

Jun 17, 2026

Description

An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly.

Vendors: mantisbt
Products: mantisbt
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.