High severity · published Jul 29, 2025
CVE-2025-44137
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal
8.2
CVSS
1.4%
EPSS
No
On KEV
Description
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TP
Tileserver Php · Maptiler
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-44137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-44137
github.com
https://github.com/maptiler/tileserver-php/commit/4fe14e6164bbe2a3f9e3b3d7acf303e3ec210c8e
Exploit
https://github.com/maptiler/tileserver-php/issues/167
Exploit
https://github.com/mheranco/CVE-2025-44137
More from Tileserver Php
9.8
CVE-2025-44136
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS)