---
id: CVE-2026-62944
aliases:
  - GHSA-h2wf-967x-gxvw
title: 'MantisBT: Stored XSS in print_all_bug_page_word.php'
summary: 'MantisBT: Stored XSS in print_all_bug_page_word.php'
severity: high
cwe:
  - CWE-79
vendor: mantisbt
product: mantisbt/mantisbt
ecosystem: composer
affected:
  - mantisbt/mantisbt <= 2.28.3
patched:
  - mantisbt/mantisbt 2.28.4
published: '2026-07-15'
updated: '2026-07-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-h2wf-967x-gxvw'
references:
  - url: >-
      https://github.com/mantisbt/mantisbt/security/advisories/GHSA-h2wf-967x-gxvw
  - url: >-
      https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa
  - url: 'https://mantisbt.org/bugs/view.php?id=37234'
  - url: 'https://github.com/advisories/GHSA-h2wf-967x-gxvw'
tags:
  - ghsa
  - composer
ingestedAt: '2026-07-15T19:45:40.694Z'
---

## Overview

A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as `probe." onload="alert(1)`. 

When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes `<img src="..." alt="" onload="alert(1)" />`, breaking out of the alt attribute. 

### Impact
Cross-site scripting.

Impact is limited by MantisBT's Content Security Policy.

### Patches
- https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa

### Workarounds
None

### Resources
- https://mantisbt.org/bugs/view.php?id=37234

### Credits
MantisBT thanks the [Dracosec Research Limited](https://dracosec.tech/) team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.

## Affected packages

- `mantisbt/mantisbt <= 2.28.3`

## Remediation

Upgrade to a patched release:

- `mantisbt/mantisbt 2.28.4`