GHSA-h2wf-967x-gxvw

Suggest an improvement
Source
https://github.com/advisories/GHSA-h2wf-967x-gxvw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-h2wf-967x-gxvw/GHSA-h2wf-967x-gxvw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h2wf-967x-gxvw
Aliases
  • CVE-2026-62944
Published
2026-07-15T18:56:00Z
Modified
2026-07-15T19:11:50Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
MantisBT: Stored XSS in print_all_bug_page_word.php
Details

A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's alt attribute via an image attachment with a crafted filename such as probe." onload="alert(1).

When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes <img src="..." alt="" onload="alert(1)" />, breaking out of the alt attribute.

Impact

Cross-site scripting.

Impact is limited by MantisBT's Content Security Policy.

Patches

Workarounds

None

Resources

Credits

MantisBT thanks the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-15T18:56:00Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Packagist / mantisbt/mantisbt

Package

Name
mantisbt/mantisbt
Purl
pkg:composer/mantisbt/mantisbt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.28.4

Affected versions

2.*
2.3.0
2.3.1
2.3.2
2.3.3
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.6.0
2.7.0
2.7.1
2.8.0
2.8.1
2.9.0
2.9.1
2.10.0
2.10.1
2.11.0
2.11.1
2.12.0
2.12.1
2.12.2
2.13.0
2.13.1
2.13.2
2.14.0
2.15.0
2.15.1
2.16.0
2.16.1
2.17.0
2.17.1
2.17.2
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.20.1
2.21.0
2.21.1
2.21.2
2.21.3
2.22.0
2.22.1
2.22.2
2.23.0
2.23.1
2.24.0
2.24.1
2.24.2
2.24.3
2.24.4
2.24.5
2.25.0
2.25.1
2.25.2
2.25.3
2.25.4
2.25.5
2.25.6
2.25.7
2.25.8
2.26.0
2.26.1
2.26.2
2.26.3
2.26.4
2.27.0
2.27.1
2.27.2
2.27.3
2.28.0
2.28.1
2.28.2
2.28.3

Database specific

last_known_affected_version_range 
"<= 2.28.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-h2wf-967x-gxvw/GHSA-h2wf-967x-gxvw.json"