CVE-2026-62944

Description

The vulnerability exists due to a missing output encoding call within the Word export component. The application fails to properly sanitize the filename of uploaded image attachments. This flaw allows an authenticated user to inject arbitrary HTML payloads into an image tag's alternative text attribute, leading to Stored Cross-Site Scripting (XSS) when another user exports or views the affected bug tracking page.

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4