CVE-2025-59431highCWE-89

CVE-2025-59431: high-severity vulnerability in MapServer

MapServer - WFS XML Filter Query SQL injection

Published

Follow this CVE+ Monitor MapServer+ Monitor mapserver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.9epss 0.4%
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
MapServer · MapServer
Related CVEs — MapServer

In the same product, most dangerous first.

CVE-2026-33721MEDIUMMapServer has heap buffer overflow in SLD `Categorize` Threshold parsingEPSS 1.2%CVE-2026-54354HIGHMapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query TranslationEPSS 0.7%CVE-2026-54355MEDIUMMapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`EPSS 0.5%CVE-2026-45104HIGHMapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`EPSS 0.3%CVE-2026-42030MEDIUMMapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewerEPSS 0.2%