View Issue Details

WikiRelated ChangesetsJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0037219mantisbtsecuritypublic2026-05-31 18:332026-07-06 04:14
Reporterxananasx7 Assigned Tocommunity  
PrioritynormalSeverityminorReproducibilityhave not tried
Status resolvedResolutionfixed 
Target Version2.29.0Fixed in Version2.29.0 
Summary0037219: Security: Add allowed_classes => false to unserialize() calls to prevent PHP Object Injection
Description

The following functions call unserialize() without specifying allowed_classes:

  • filter_api.php (filter deserialization from session/database)
  • email_queue_api.php (email queue deserialization)
  • safe_unserialize() helper

This leaves them potentially vulnerable to PHP Object Injection (POI) via gadget
chains using classes already loaded in memory, even when the data source appears
trusted.

Fix: Add ['allowed_classes' => false] as a defence-in-depth hardening measure.
The deserialized data in these locations is always a plain array of scalar values —
no object instantiation is expected — so this change does not affect functionality.

GitHub PR with the fix: https://github.com/mantisbt/mantisbt/pull/2229

TagsNo tags attached.

Activities

dregad

dregad

2026-05-31 19:11

developer   ~0071207

Thanks for creating the issue. I'll review the PR as time allows.

Related Changesets

MantisBT: master e423fd3e

2026-07-06 04:12

XananasX

Committer: community


Details Diff		 Add allowed_classes restriction to unserialize() calls

Add `allowed_classes => false` to unserialize() in filter_api.php and
email_queue_api.php.

Add $p_options parameter to safe_unserialize().

Update 3 safe_unserialize() calls in install_helper_functions_api.php
to pass `['allowed_classes' => false]`, consistent with the changes in
filter_api.php and email_queue_api.php.

Fixes 0037219, PR https://github.com/mantisbt/mantisbt/pull/2229

Co-authored-by: XananasX7 <xananasX7@users.noreply.github.com>		 Affected Issues
0037219
mod - core/email_queue_api.php Diff File
mod - core/filter_api.php Diff File
mod - core/install_helper_functions_api.php Diff File
mod - core/utility_api.php Diff File