---
id: CVE-2026-54355
title: MapServer is a system for developing web-based GIS applications
summary: >-
  MapServer is a system for developing web-based GIS applications. From 6.0
  until 8.6.4, MapServer's OpenLayers HTML output for
  SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an
  attacker-controlled X-Forwarded-Host value…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N'
cwe:
  - CWE-79
vendor: MapServer
product: MapServer
affected:
  - 'MapServer >= 6.0, < 8.6.4'
published: '2026-09-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:17:15.957'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54355'
references:
  - url: >-
      https://github.com/MapServer/MapServer/commit/edc1033c7963fcffd160d85cf430f49aaf4a1374
    label: security-advisories@github.com
  - url: >-
      https://github.com/MapServer/MapServer/commit/ff17ef190caaeaa9002ac3d1c7969ec5315c345e
    label: security-advisories@github.com
  - url: 'https://github.com/MapServer/MapServer/pull/7517'
    label: security-advisories@github.com
  - url: 'https://github.com/MapServer/MapServer/pull/7518'
    label: security-advisories@github.com
  - url: 'https://github.com/MapServer/MapServer/releases/tag/rel-8-6-4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/MapServer/MapServer/security/advisories/GHSA-xqj6-vjqr-33vv
    label: security-advisories@github.com
  - url: >-
      https://mapserver.org/development/changelog/changelog-8-6.html#changelog-8-6
    label: security-advisories@github.com
  - url: >-
      https://github.com/MapServer/MapServer/security/advisories/GHSA-xqj6-vjqr-33vv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T20:45:53.514616Z'
cvssSource: cna
epss: 0.0068
epssPercentile: 0.50287
ingestedAt: '2026-09-17T21:29:16.981Z'
---

## Overview

MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.