CVE-2026-54355

MediumCVSS 5.3/10Last modified Sep 30, 2026

Description

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MapServerMapServer>= 6.0, < 8.6.4

References

Timeline

Published
Sep 17, 2026
Last modified
Sep 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-543567.1Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/staCVE-2026-543575.1An improper authorization vulnerability in MISP allowed an authenticated organization administrator to access or modify user settings belongCVE-2026-543587.5An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to theCVE-2026-543597.1MISP contains an insecure default configuration in which the Security.check_sec_fetch_site_header control is disabled. When this setting is CVE-2026-54368.1The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insuCVE-2026-543608.4A mass assignment vulnerability exists in MISP’s sharing group creation endpoint. When creating a new sharing group, the controller did not CVE-2026-543618.8MISP contained multiple mass assignment vulnerabilities in the handling of collections, tag collections, event delegations, and shadow attriCVE-2026-543625.3An incorrect visibility condition in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that shouldCVE-2026-543639.1CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypCVE-2026-543646.5CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary sessioCVE-2026-543657.5CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers tCVE-2026-543667.5CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate ar