Mantis Bug Tracker contains a stored Cross‑Site Scripting flaw that is triggered when an issue is cloned from a project different than the current one. The clone form shows the source project’s name before the category selector, but the name is inserted without escaping. An attacker who can modify a project’s name—normally a manager or administrator—can inject arbitrary HTML or JavaScript. When the cloned issue is later viewed by other users the injected code executes in their browsers, enabling session hijacking, credential theft, or defacement of the web interface and thereby compromising confidentiality and integrity for all affected users.

The vulnerability affects the Mantis Bug Tracker (mantisbt) software versions 2.28.1 and earlier. The flaw was fixed in version 2.28.2 and later releases.

The assigned CVSS score of 8.6 classifies this flaw as high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. Exploitation requires privileged access to alter a project name, after which an internal attacker can clone an issue and trigger the stored XSS. Because the flaw is active in a commonly used open‑source product, environments that deploy vulnerable versions should treat this as a significant risk.