The vulnerability arises when MantisBT fails to escape the owner field of a saved filter. If the global setting to display real user names is enabled, an attacker with Manager or higher privileges can inject arbitrary HTML or JavaScript into that field. The input is rendered in any page that lists the filter, allowing the attacker to execute script in the browsers of other users who view the filter. This flaw can be used to perform phishing attacks, session hijacking, or arbitrary data exfiltration from the victim’s session. The weakness is a classic Stored XSS (CWE‑79).

The defect affects Mantis Bug Tracker versions 2.11.0 through 2.28.1. These releases are distributed under the MIT license and are available from the official project repository. The issue is fixed in 2.28.2 and later releases. The problem is only exploitable when the configuration setting $g_show_user_realname is set to ON and when a user with Manager or higher access level saves their filter publicly; publicly stored filters are visible to all users.

The CVSS score of 7.5 indicates high severity, and the absence of an EPSS score makes it unclear how frequently attacks occur, but the vulnerability is present in a wide range of publicly accessible installations. It is not listed in CISA’s KEV catalog, suggesting no known large‑scale exploitation. Attackers would need to compromise a user account with Manager privileges to create a malicious filter; however, the stored payload would then affect all users that view the filter, enabling mass‑impact XSS. The risk is primarily confined to the web interface and requires that the application be deployed with the real‑name display enabled.