Mantis Bug Tracker (MantisBT) contains a stored cross‑site scripting flaw triggered by textarea custom fields on the bug edit page. Improper escaping of user‑supplied content allows an attacker to inject arbitrary HTML and, if the page's Content‑Security‑Policy permits, execute JavaScript upon rendering. This can facilitate session hijacking, enabling a compromised user to impersonate administrators and gain full project‑level data access. The weakness corresponds to CWE‑79, involving unsanitized output.

Both the 2.28.1 release and any older version of MantisBT are affected. The flaw was resolved in 2.28.2, so any deployment running 2.28.2 or newer is immune. For environments that cannot promptly upgrade, the vendor recommends applying the default CSP, which blocks script execution and mitigates the exploitation risk.

The CVSS base score is 5.4, indicating a medium severity, and EPSS not available; KEV not listed in KEV. To exploit the mishandling, an attacker must first be authenticated with bug‑reporting rights within the target project and then insert malicious payloads into a textarea‑type custom field. Once a victim views the vulnerable edit form, the injected script can run, leading to credential theft or further compromise. Because the attack vector resides inside the web application, a compromised or high‑privilege account within the project can be used to trigger the payload, making the issue especially dangerous for users with low‑privilege bug‑reporting permissions.