The vulnerability arises from improper escaping of tag names that are retrieved from the history log and displayed in the timeline view of MantisBT. An attacker who can create or rename a tag with specially crafted characters can cause the tag name to be rendered as live HTML when the timeline is viewed. If the site’s Content‑Security‑Policy allows inline scripts or execution of data‑originated code, this stored injection can lead to the execution of arbitrary JavaScript in the context of the logged‑in user, potentially allowing credential theft, session hijacking, or full compromise of the web application.

Mantis Bug Tracker version 2.28.0 is vulnerable. The fix was applied in 2.28.1. Any instance running the unpatched version with the timeline feature enabled is at risk. The issue specifically affects the my_view_page.php script that renders issue timelines.

The CVSS v3 base score of 8.6 classifies the issue as high severity, with an attack vector that is user‑controllable via tag manipulation, requiring user interaction and legitimate access to the application’s interface. The EPSS score is below 1 %, suggesting few observed attacks, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the combination of stored XSS and the possibility of bypassing CSP makes it a worthwhile target for attackers with moderate resources.