GHSA-h2wf-967x-gxvw: MantisBT: Stored XSS in print_all_bug_page_word.php
MantisBT versions prior to 2.28.4 contain a stored cross-site scripting (XSS) vulnerability in the print_all_bug_page_word.php script. This occurs due to missing output encoding on the alt attribute of an IMG tag, allowing authenticated users to inject arbitrary HTML by crafting image attachment filenames. The vulnerability is mitigated to some extent by MantisBT's Content Security Policy. A patch addressing this issue is available in version 2.28.4. No workarounds are provided.
AI Analysis
Technical Summary
A stored XSS vulnerability exists in MantisBT's print_all_bug_page_word.php where a missing output encoding call allows authenticated users to inject arbitrary HTML into the alt attribute of an IMG tag via crafted image attachment filenames. When the HTML export page is viewed, the injected code executes, potentially leading to cross-site scripting attacks. The impact is limited by the application's Content Security Policy. The issue is fixed in MantisBT version 2.28.4.
Potential Impact
Allows authenticated users to perform stored cross-site scripting by injecting arbitrary HTML/JavaScript into the alt attribute of IMG tags in exported HTML pages. This could lead to script execution in the context of users viewing the export page. The impact is mitigated by the existing Content Security Policy but still represents a high-severity vulnerability.
Mitigation Recommendations
Upgrade MantisBT to version 2.28.4 or later where the vulnerability is patched. No workarounds are available. Applying the official fix is the recommended remediation.
GHSA-h2wf-967x-gxvw: MantisBT: Stored XSS in print_all_bug_page_word.php
Description
MantisBT versions prior to 2.28.4 contain a stored cross-site scripting (XSS) vulnerability in the print_all_bug_page_word.php script. This occurs due to missing output encoding on the alt attribute of an IMG tag, allowing authenticated users to inject arbitrary HTML by crafting image attachment filenames. The vulnerability is mitigated to some extent by MantisBT's Content Security Policy. A patch addressing this issue is available in version 2.28.4. No workarounds are provided.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A stored XSS vulnerability exists in MantisBT's print_all_bug_page_word.php where a missing output encoding call allows authenticated users to inject arbitrary HTML into the alt attribute of an IMG tag via crafted image attachment filenames. When the HTML export page is viewed, the injected code executes, potentially leading to cross-site scripting attacks. The impact is limited by the application's Content Security Policy. The issue is fixed in MantisBT version 2.28.4.
Potential Impact
Allows authenticated users to perform stored cross-site scripting by injecting arbitrary HTML/JavaScript into the alt attribute of IMG tags in exported HTML pages. This could lead to script execution in the context of users viewing the export page. The impact is mitigated by the existing Content Security Policy but still represents a high-severity vulnerability.
Mitigation Recommendations
Upgrade MantisBT to version 2.28.4 or later where the vulnerability is patched. No workarounds are available. Applying the official fix is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-h2wf-967x-gxvw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-62944"]
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a58b44368715ace43d6abca
Added to database: 07/16/2026, 10:36:51 UTC
Last enriched: 07/16/2026, 11:22:21 UTC
Last updated: 07/17/2026, 01:23:35 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.