CVE-2026-42030

EUVD-2026-28807

08.05.2026, 17:16

MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.

Basic XSS

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 15.95%

Affected Products (NVD)

Vendor	Product	Version
osgeo	mapserver	6.0.0 ≤ 𝑥 < 8.6.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

mapserver

bookworm	postponed
bullseye	postponed
bullseye (security)	vulnerable
forky	8.6.5-1 fixed
sid	8.6.5-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

mapserver

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
xenial	ignored

Known Exploits!

Common Weakness Enumeration

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References

https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2

https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x

https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x