CVE-2026-54355 MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResourc...

CVE-2026-54355

MapServer (a web-based GIS application system) is affected by a reflected XSS in its OpenLayers HTML output. Versions from 6.0 through 8.6.3 reflect an attacker-controlled X-Forwarded-Host header value without escaping it for a single-quoted JavaScript string when handling SERVICE=WMS&REQUEST=Get...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

EUVD-2026-82431

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354

CVE-2026-54354 is a SQL injection vulnerability in MapServer prior to version 8.6.4 , affecting the PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter(). When a connection type of POSTGIS is configured with metadata such as gml__type=Integer, the code treat...

CVE-2026-54354: Improper Neutralization of Special Elements used in an SQL Command

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml type=Integer are configured,...

PT-2026-95102

Name of the Vulnerable Software and Affected Versions MapServer versions 6.0 through 8.6.3 Description MapServer's OpenLayers HTML output for the endpoint SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP X FORWARDED...

CVE-2026-54355: Improper Neutralization of Input During Web Page Generation

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTPXFORWARDEDHOST through msBuildOnlineResourc...

PT-2026-95101

Name of the Vulnerable Software and Affected Versions MapServer versions prior to 8.6.4 Description MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and the msPostGISLayerTranslateFilter function fails to verify that input from the CGI qstring or OGC API Features featureId is ...

MapServer Unverified Array Indexing DoS

The vulnerability of the MapServer geographic data rendering system is related to unvalidated array indexing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

MapServer Path Traversal

The vulnerability of the MapServer geographic data rendering system is related to deficiencies in path name restriction. Exploiting this vulnerability could allow an attacker to compromise the integrity of the data...

OSV-2026-1198 Stack-buffer-overflow in msLayoutTextSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=551099259 Crash type: Stack-buffer-overflow READ 4 Crash state: msLayoutTextSymbol msWriteErrorImage msWMSException...

MapServer SLD Buffer Overflow DoS

The vulnerability of the MapServer geographic data rendering parser’s SLD system is related to buffer overflow vulnerabilities. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

mapserver:owsfuzzer: Stack-buffer-overflow in msLayoutTextSymbol

Project: https://github.com/MapServer/MapServer.git Detailed Report: https://oss-fuzz.com/testcase?key=6243451692449792 Project: mapserver Fuzzing Engine: honggfuzz Fuzz Target: owsfuzzer Job Type: honggfuzzasanmapserver Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address:...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Starting from version 4.2 and before version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD Styled Layer Descriptor parser allowed a remote, unauthenticated attacker to crash the MapServer process by sending a crafted SLD...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Prior to version 8.4.1, the XML Filter Query directive’s PropertyName was vulnerable to Boolean-based SQL injection. It seems that expression checking was bypassed by introducing double quote characters in PropertyName, allowing...

Security update for mapserver (important)

openSUSE security update: security update for mapserver ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20857-1 Rating: important References: bsc1260869 bsc1266663 Cross-References: CVE-2026-33721 CVE-2026-45104 Affected Products: openSUSE Leap 16.0...