MantisBT CVE-2026-62944
HIGH
GHSA-h2wf-967x-gxvw
Severity by source
Authenticated user stores the payload (PR:L) but a victim must open the export page (UI:R); XSS crosses into the victim's browser context (S:C) with limited C/I impact partly curbed by CSP.
Lifecycle Timeline
3DescriptionCVE.org
A missing output encoding call in print_all_bug_page_word.php allows any authenticated user to inject arbitrary HTML into an IMG tag's *alt* attribute via an image attachment with a crafted filename such as probe." onload="alert(1).
When any user views the HTML export page (print_all_bug_page_word.php?type_page=html&export=1), the rendered IMG tag becomes <img src="..." alt="" onload="alert(1)" />, breaking out of the alt attribute.
Impact
Cross-site scripting.
Impact is limited by MantisBT's Content Security Policy.
Patches
- https://github.com/mantisbt/mantisbt/commit/bdd0e364f62759de272dfd4c89b4f51d27be9daa
Workarounds
None
Resources
- https://mantisbt.org/bugs/view.php?id=37234
Credits
MantisBT thanks the Dracosec Research Limited team (Chris Chan, Krecendo Hui, William Lam) for discovering and responsibly reporting the issue.
AnalysisAI
Stored cross-site scripting in MantisBT (versions <= 2.28.3) lets an authenticated user inject arbitrary HTML/JavaScript through a crafted image-attachment filename that breaks out of an IMG tag's alt attribute. The payload executes when any user (including higher-privileged reviewers) renders the Word/HTML export view at print_all_bug_page_word.php?type_page=html&export=1, though real-world impact is constrained by MantisBT's Content Security Policy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated MantisBT account with permission to add file attachments to a bug, and the ability to control the uploaded image's filename to embed an attribute-breakout payload (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score or vector was provided by the source, so severity must be inferred. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user with attachment-upload rights adds an image to a bug report using a crafted filename such as `probe." onload="alert(1)`, storing the payload. When a project manager or other user later opens the HTML export of that report, the malformed IMG tag executes the injected script in their session, subject to whatever the site's CSP allows. … |
| Remediation | Vendor-released patch: upgrade to MantisBT 2.28.4, which adds output encoding (string_html_specialchars/htmlspecialchars) around the attachment alt text, display name, path, and download URL in print_all_bug_page_word.php (fixing commit bdd0e364f62759de272dfd4c89b4f51d27be9daa; advisory GHSA-h2wf-967x-gxvw). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all MantisBT deployments and confirm running versions; if using versions 2.28.3 or earlier, disable the Word/HTML export functionality (print_all_bug_page_word.php?type_page=html) at the firewall or application level as a temporary block. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today