CVE-2026-62944 json
MantisBT: Stored XSS in print_all_bug_page_word.php
published 2026-07-15 3 mo ago modified 2026-07-15 3 mo ago also GHSA-h2wf-967x-gxvw
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as `probe." onload="alert(1)`.
When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes `<img src="..." alt="" onload="alert(1)" />`, breaking out of the alt attribute.
### Impact Cross-site scripting.
Impact is limited by MantisBT's Content Security Policy.
### Patches - https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa
### Workarounds None
### Resources - https://mantisbt.org/bugs/view.php?id=37234
### Credits MantisBT thanks the [Dracosec Research Limited](https://dracosec.tech/) team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.
Patch / fix
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mantisbt/mantisbt | <2.28.4 |
2.28.4 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- GitHub Advisory GHSA-h2wf-967x-gxvw
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.