CVE-2026-54355
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim. This issue is fixed in version 8.6.4.
Risk Assessment
An attacker can access the victim's sessions or tokens, same-origin data and requests, and perform actions as the victim. The risk occurs when the deployment trusts the X-Forwarded-Host header and lacks a fixed onlineresource configuration.
Recommendation
Update MapServer to version 8.6.4 or later. Configure a fixed ows_onlineresource or MS_ONLINERESOURCE value and do not trust the X-Forwarded-Host header from unknown sources.
Other vulnerabilities in MapServer
See all- CVE-2016-9839High
In MapServer before version 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
- CVE-2025-59431Critical
MapServer prior to 8.4.1 is vulnerable to Boolean-based SQL injection in the PropertyName directive of the XML Filter Query. Expression checking is bypassed by introducing double quote characters in PropertyName, allowing manipulation of backend database queries. The vulnerability is fixed in 8.4.1.
- CVE-2017-5522Critical
A stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
- CVE-2026-54354High
In MapServer prior to 8.6.4, PostGIS filter translation in msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and Integer metadata are configured, but does not verify that attacker-controlled CGI or OGC API Features input is a numeric literal. The unquoted input is concatenated into the SQL predicate, enabling SQL injection.
Original NVD description (English source)
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS