SQL injection in MapServer - CVE-2026-54354
Published: August 27, 2026
Vulnerability identifier: #VU146005
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54354
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to SQL injection in msPostGISLayerTranslateFilter() in src/mappostgis.cpp when translating runtime filters for PostGIS layers using attacker-controlled numeric filter values from CGI qstring or OGC API Features featureId. A remote attacker can send a specially crafted query parameter value to disclose sensitive information.
Only deployments exposing CGI query endpoints or OGC API Features endpoints backed by PostGIS layers are affected, and the issue occurs when the queried filter item is marked as numeric through layer metadata.
Affected software
MapServer
How to mitigate CVE-2026-54354
Install security update from vendor's website.
MapServer - update to 8.6.4