CVE-2017-12419

CVE-2017-12419 describes a vulnerability in MantisBT versions through 2.5.2 when used with MySQL/MariaDB. If the administrator fails to remove the 'admin' directory post-installation and the MySQL client has local_infile enabled, an authenticated attacker can exploit MySQL's "connect file read" feature to remotely access files on the MantisBT server. This medium-severity vulnerability (CVSS 4.9) has a high confidentiality impact, requiring high privileges but no user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.