[HIGH] MantisBT: Remote Code Execution via eval() Class Hoisting in adm_config_set.php

PKSA-5jjt-2py9-5v67 CVE-2026-49273 GHSA-v84x-qvhg-f36r

Affected package: mantisbt/mantisbt

Affected version: >=1.3.0,<=2.28.3

Reported by:
GitHub