CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to a reflected Cross-Site Scripting (XSS) flaw. The root cause is the lack of HTML encoding when reflecting the GET parameter "layer" in an error message. An unauthenticated attacker can exploit this via the "/api/v1/layer" endpoint to execute arbitrary ...

CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to a Directory Traversal vulnerability within the renderTile function of tileserver.php. The root cause is the improper sanitization of GET parameters, specifically TileMatrix, TileRow, TileCol, and Format. This allows an unauthenticated attacker to inse...