A stored XSS flaw exists in MantisBT before version 2.28.2. By uploading a specially crafted XHTML file that references a JavaScript attachment and later downloading it with the show_inline=1 parameter and a valid CSRF token, an attacker can cause the victim’s browser to execute arbitrary JavaScript. This can lead to credential theft, session hijacking, or malicious code execution in the context of the victim’s browser session.

The vulnerability affects the open‑source MantisBT issue‑tracking application, specifically any installation of the bug tracker with a version earlier than 2.28.2. No other vendors are listed; MantisBT is the sole affected product.

The CVSS score of 7.5 indicates a high severity of the flaw, while the EPSS score is not available and the vulnerability is not recorded in the CISA KEV catalog. The likely attack vector is through the web interface, with exploitability requiring the attacker to upload a malicious attachment and a victim to download it with the show_inline flag set. Successful exploitation would allow the attacker to execute arbitrary JavaScript in the victim’s browser, compromising data confidentiality and integrity on the client side.