{"id":"CVE-2026-62944","aliases":["GHSA-h2wf-967x-gxvw"],"title":"MantisBT: Stored XSS in print_all_bug_page_word.php","summary":"MantisBT: Stored XSS in print_all_bug_page_word.php","severity":"high","cwe":["CWE-79"],"vendor":"mantisbt","product":"mantisbt/mantisbt","ecosystem":"composer","affected":["mantisbt/mantisbt <= 2.28.3"],"patched":["mantisbt/mantisbt 2.28.4"],"published":"2026-07-15","updated":"2026-07-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-h2wf-967x-gxvw","references":[{"url":"https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h2wf-967x-gxvw"},{"url":"https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa"},{"url":"https://mantisbt.org/bugs/view.php?id=37234"},{"url":"https://github.com/advisories/GHSA-h2wf-967x-gxvw"}],"tags":["ghsa","composer"],"ingestedAt":"2026-07-15T19:45:40.694Z","slug":"CVE-2026-62944","body":"## Overview\n\nA missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as `probe.\" onload=\"alert(1)`. \n\nWhen any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes `<img src=\"...\" alt=\"\" onload=\"alert(1)\" />`, breaking out of the alt attribute. \n\n### Impact\nCross-site scripting.\n\nImpact is limited by MantisBT's Content Security Policy.\n\n### Patches\n- https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa\n\n### Workarounds\nNone\n\n### Resources\n- https://mantisbt.org/bugs/view.php?id=37234\n\n### Credits\nMantisBT thanks the [Dracosec Research Limited](https://dracosec.tech/) team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.\n\n## Affected packages\n\n- `mantisbt/mantisbt <= 2.28.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mantisbt/mantisbt 2.28.4`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}