CVE-2025-59431
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
MapServer prior to 8.4.1 is vulnerable to Boolean-based SQL injection in the PropertyName directive of the XML Filter Query. Expression checking is bypassed by introducing double quote characters in PropertyName, allowing manipulation of backend database queries. The vulnerability is fixed in 8.4.1.
Risk Assessment
An attacker could execute unauthorized database queries, potentially leading to leakage or modification of GIS data. This requires access to the XML query functionality.
Recommendation
Update MapServer to version 8.4.1 or later. Restrict access to the XML Filter Query functionality to trusted users.
Other vulnerabilities in MapServer
See all- CVE-2016-9839High
In MapServer before version 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.
- CVE-2017-5522Critical
A stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving WFS get feature requests.
- CVE-2026-54355Medium
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim. This issue is fixed in version 8.6.4.
- CVE-2026-54354High
In MapServer prior to 8.6.4, PostGIS filter translation in msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and Integer metadata are configured, but does not verify that attacker-controlled CGI or OGC API Features input is a numeric literal. The unquoted input is concatenated into the SQL predicate, enabling SQL injection.
Original NVD description (English source)
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS