Critical severity · published Sep 19, 2025
CVE-2025-59431
MapServer is a system for developing web-based GIS applications
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mapserver · Osgeo
8.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59431
Exploit
https://github.com/MapServer/MapServer/security/advisories/GHSA-256m-rx4h-r55w
More from Mapserver
9.8
CVE-2017-5522
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash)…
7.5
CVE-2026-45104
MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`
7.5
CVE-2026-33721
MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing
7.5
CVE-2010-1678
Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing
7.5
CVE-2016-9839
In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails