SB20260827148 - Multiple vulnerabilities in MapServer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260827148

SB20260827148 - Multiple vulnerabilities in MapServer

Published: August 27, 2026

Security Bulletin ID SB20260827148
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) SQL injection (CVE-ID: CVE-2026-54354)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to SQL injection in msPostGISLayerTranslateFilter() in src/mappostgis.cpp when translating runtime filters for PostGIS layers using attacker-controlled numeric filter values from CGI qstring or OGC API Features featureId. A remote attacker can send a specially crafted query parameter value to disclose sensitive information.

Only deployments exposing CGI query endpoints or OGC API Features endpoints backed by PostGIS layers are affected, and the issue occurs when the queried filter item is marked as numeric through layer metadata.


2) Cross-site scripting (CVE-ID: CVE-2026-54355)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim\'s browser.

The vulnerability exists due to cross-site scripting in the OpenLayers HTML output when processing a WMS GetMap request with FORMAT=application/openlayers and an attacker-controlled X-Forwarded-Host value reaches HTTP_X_FORWARDED_HOST. A remote attacker can send a specially crafted request or crafted URL to execute arbitrary JavaScript in the victim\'s browser.

User interaction is required to open an attacker-crafted URL, and exploitation depends on deployments that pass externally controlled forwarded host headers to MapServer and do not override the generated online resource with a fixed trusted value.


Remediation

Install update from vendor's website.

References