{
"id": "GHSA-h2wf-967x-gxvw",
"aliases": [
"CVE-2026-62944"
],
"details": "A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as `probe.\" onload=\"alert(1)`. \n\nWhen any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes `<img src=\"...\" alt=\"\" onload=\"alert(1)\" />`, breaking out of the alt attribute. \n\n### Impact\nCross-site scripting.\n\nImpact is limited by MantisBT's Content Security Policy.\n\n### Patches\n- https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa\n\n### Workarounds\nNone\n\n### Resources\n- https://mantisbt.org/bugs/view.php?id=37234\n\n### Credits\nMantisBT thanks the [Dracosec Research Limited](https://dracosec.tech/) team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.",
"summary": "MantisBT: Stored XSS in print_all_bug_page_word.php",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.28.4"
}
]
}
],
"package": {
"name": "mantisbt/mantisbt",
"ecosystem": "Packagist"
},
"database_specific": {
"last_known_affected_version_range": "<= 2.28.3"
}
}
],
"modified": "2026-07-15T18:56:00Z",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
}
],
"published": "2026-07-15T18:56:00Z",
"references": [
{
"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h2wf-967x-gxvw",
"type": "WEB"
},
{
"url": "https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa",
"type": "WEB"
},
{
"url": "https://github.com/mantisbt/mantisbt",
"type": "PACKAGE"
},
{
"url": "https://mantisbt.org/bugs/view.php?id=37234",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-07-15T18:56:00Z"
}
}