Which versions of MantisBT are affected by CVE-2026-62944?

MantisBT versions 2.28.3 and earlier contain a stored cross-site scripting vulnerability allowing authenticated users to inject malicious code into bug reports that executes when other team members…. A patch is available.

How to fix or mitigate CVE-2026-62944?

Within 24 hours: Inventory all MantisBT deployments and confirm running versions; if using versions 2.28.3 or earlier, disable the Word/HTML export functionality (print_all_bug_page_word.php?type_page=html) at the firewall or application level as a temporary block. Within 7 days: Upgrade all affected MantisBT instances to version 2.28.4 or later; coordinate with development teams and complete the upgrade during a scheduled maintenance window, testing the export functionality in a staging environment before production rollout. Within 30 days: Audit bug reports created while running vulnerable versions for suspicious filenames or attachment names that may indicate exploitation attempts; review access logs to identify which users accessed export features and determine whether any exported content was distributed externally.

MantisBT CVE-2026-62944

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 https://github.com/mantisbt/mantisbt

GHSA-h2wf-967x-gxvw

PHP XSS

Severity by source

vuln.today AI

5.4 MEDIUM

Authenticated user stores the payload (PR:L) but a victim must open the export page (UI:R); XSS crosses into the victim's browser context (S:C) with limited C/I impact partly curbed by CSP.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 19:16 vuln.today

Analysis Generated

Jul 15, 2026 - 19:16 vuln.today

CVE Published

Jul 15, 2026 - 18:56 cve.org

HIGH

DescriptionCVE.org

A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as probe." onload="alert(1).

When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes <img src="..." alt="" onload="alert(1)" />, breaking out of the alt attribute.

Impact

Cross-site scripting.

Impact is limited by MantisBT's Content Security Policy.

Patches

https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa

Workarounds

None

Resources

https://mantisbt.org/bugs/view.php?id=37234

Credits

MantisBT thanks the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.

AnalysisAI

Stored cross-site scripting in MantisBT (versions <= 2.28.3) lets an authenticated user inject arbitrary HTML/JavaScript through a crafted image-attachment filename that breaks out of an IMG tag's alt attribute. The payload executes when any user (including higher-privileged reviewers) renders the Word/HTML export view at print_all_bug_page_word.php?type_page=html&export=1, though real-world impact is constrained by MantisBT's Content Security Policy. There is no public exploit identified at time of analysis, and the flaw is fixed in 2.28.4.

Technical ContextAI

MantisBT is a widely used open-source, PHP-based web bug-tracking system (packaged as composer/mantisbt/mantisbt). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): in print_all_bug_page_word.php the attachment's alt text and related fields were echoed directly into HTML without output encoding. The vulnerable line rendered <img src="..." alt="', $t_attachment['alt'], '" /> with no escaping, so a filename containing a double-quote (e.g. probe." onload="alert(1)) closes the alt attribute and introduces a new event-handler attribute. The vendor fix wraps the download URL, path, display name, and alt value in string_html_specialchars()/htmlspecialchars(), neutralizing quote and angle-bracket breakout in the export renderer.

RemediationAI

Vendor-released patch: upgrade to MantisBT 2.28.4, which adds output encoding (string_html_specialchars/htmlspecialchars) around the attachment alt text, display name, path, and download URL in print_all_bug_page_word.php (fixing commit bdd0e364f62759de272dfd4c89b4f51d27be9daa; advisory GHSA-h2wf-967x-gxvw). The vendor lists no official workarounds. Since exploitation depends on an uploaded image attachment with a crafted filename rendered on the HTML export page, interim compensating controls include restricting attachment-upload privileges to trusted users, validating/sanitizing uploaded filenames, avoiding use of the HTML/Word export view (print_all_bug_page_word.php?type_page=html&export=1) until patched, and enforcing a strict Content Security Policy without unsafe-inline to block inline event-handler execution - noting that these controls reduce usability (blocking exports or attachments) and that a permissive CSP would leave the flaw exploitable.