CVE-2026-62944
MantisBT: Stored XSS in print_all_bug_page_word.php
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert(1).
When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes <img src="..." alt="" onload="alert(1)" />, breaking out of the alt attribute.
Impact
Cross-site scripting.
Impact is limited by MantisBT's Content Security Policy.
Patches
Workarounds
None
Resources
Credits
MantisBT thanks the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-h2wf-967x-gxvw
MantisBT: Stored XSS in print_all_bug_page_word.php
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert(1).
When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes <img src="..." alt="" onload="alert(1)" />, breaking out of the alt attribute.
Impact
Cross-site scripting.
Impact is limited by MantisBT's Content Security Policy.
Patches
Workarounds
None
Resources
Credits
MantisBT thanks the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.
- Record
GHSA-h2wf-967x-gxvw- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-h2wf-967x-gxvw
MantisBT: Stored XSS in print_all_bug_page_word.php
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert(1).
When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes <img src="..." alt="" onload="alert(1)" />, breaking out of the alt attribute.
Impact
Cross-site scripting.
Impact is limited by MantisBT's Content Security Policy.
Patches
Workarounds
None
Resources
Credits
MantisBT thanks the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.
- Record
GHSA-h2wf-967x-gxvw- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mantisbt/mantisbtPackagist |
through 2.28.3 | 2.28.4 |
mantisbt/mantisbtPackagist |
before 2.28.4, plus listed versions 2.10.02.10.12.11.02.11.12.12.0 Show 45 moreShow less2.12.12.12.22.13.02.13.12.13.22.14.02.15.02.15.12.16.02.16.12.17.02.17.12.17.22.18.02.18.12.19.02.19.12.20.02.20.12.21.02.21.12.21.22.21.32.22.02.22.12.22.22.23.02.23.12.24.02.24.12.24.22.24.32.24.42.24.52.25.02.25.12.25.22.25.32.25.42.25.52.25.62.25.72.25.82.26.02.26.1 |
2.28.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-62944 is a high vulnerability (CVSS 8.6) in mantisbt/mantisbt, published July 15, 2026. No source lists public exploit code. Fixed in mantisbt/mantisbt 2.28.4.
References
Left out here: 28 versions. The JSON record has them.