Mantis Bug Tracker allows a manager or administrator to set a project name that contains unescaped HTML. When that project name is displayed on the Move Attachments admin page, the markup is injected and stored as part of the page. The stored XSS can then execute arbitrary JavaScript in the context of any user who visits the page, potentially stealing session cookies or performing actions on behalf of the user.

The vulnerability affects MantisBT versions 1.3.0 through 2.28.1 inclusive. A fix was applied in version 2.28.2.

The CVSS score of 8.6 classifies this flaw as High severity. EPSS data is not available and the CVE is not listed in the CISA KEV catalog. Exploitation requires that the attacker already possess manager or administrator privileges, meaning the threat primarily applies to internal users with elevated rights. Within that constrained scope, an attacker can compromise user sessions or disrupt functionality, but remote unauthenticated exploitation is not possible.