Critical severity · published Jul 29, 2025
CVE-2025-44136
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS)
9.8
CVSS
2.7%
EPSS
No
On KEV
Description
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TP
Tileserver Php · Maptiler
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-44136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-44136
Exploit
https://github.com/maptiler/tileserver-php/issues/167
Exploit
https://github.com/mheranco/CVE-2025-44136
More from Tileserver Php
8.2
CVE-2025-44137
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal