The vulnerability is a reflected XSS in Mantis Bug Tracker caused by a missing validation on the filter_target parameter used in return_dynamic_filters.php. Attackers can inject arbitrary HTML when the target field is a custom TEXTAREA. The injected code can execute in the context of the affected user’s browser, enabling cross‑site scripting. This can lead to session hijacking, credential theft, or defacement. The weakness is identified as CWE‑79.

MantisBT 1.0.0 through 2.28.1 versions are vulnerable. The issue is resolved in 2.28.2. Any installation running an affected version with the custom textarea functionality enabled is at risk.

The CVSS score of 5.3 indicates moderate severity; EPSS data is unavailable and the vulnerability is not listed in KEV. The likely attack vector is via a crafted AJAX request from the View Issues page, which the attacker can trigger by luring a user to a malicious link or embedding the payload in shared issue data. Exploitation requires the victim to visit a page that triggers return_dynamic_filters.php with the injected filter_target value. Because the attack is reflected, it does not require enumeration of existing vulnerabilities, making it relatively straightforward to trigger if an attacker can attract targeted users.