CVE-2026-42030 Details
Description
MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.
A reflected cross-site scripting (XSS) vulnerability has been identified in MapServer's Web Map Service (WMS) server, affecting versions 6.0 prior to 8.6.2. This vulnerability allows an unauthenticated attacker to inject arbitrary HTML or JavaScript into the browser of any user who opens a crafted WMS URL. The issue arises in WMS 1.3.0 requests when the FORMAT parameter is set to application/openlayers, combined with an unsanitized SRS parameter. In this version, the SRS parameter is accepted without validation, enabling script injection. This vulnerability has been patched in MapServer version 8.6.2.
Users are advised to upgrade to MapServer version 8.6.2, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x | CISA-ADP | ExploitVendor Advisory |
| https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2 | [email protected] | ProductRelease Notes |
| https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osgeo mapserver | >= 6.0.0, < 8.6.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |