MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.
References
| Link | Resource |
|---|---|
| https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2 | Product Release Notes |
| https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x | Exploit Vendor Advisory |
| https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x | Exploit Vendor Advisory |
Configurations
History
14 May 2026, 18:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2 - Product, Release Notes | |
| References | () https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x - Exploit, Vendor Advisory | |
| First Time |
Osgeo
Osgeo mapserver |
|
| CPE | cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:* |
08 May 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x - |
08 May 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-08 17:16
Updated : 2026-05-14 18:04
NVD link : CVE-2026-42030
Mitre link : CVE-2026-42030
CVE.ORG link : CVE-2026-42030
JSON object : View
Products Affected
osgeo
- mapserver
CWE
CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)