Critical severity · published Sep 19, 2025
CVE-2025-59431
MapServer - WFS XML Filter Query SQL injection
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
MapServer · MapServer
< 8.4.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59431
Exploit
https://github.com/MapServer/MapServer/security/advisories/GHSA-256m-rx4h-r55w
More from MapServer
8.2
CVE-2026-54354
MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation
7.5
CVE-2026-45104
MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`
7.5
CVE-2026-33721
MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing
6.1
CVE-2026-42030
MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer
5.3
CVE-2026-54355
MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`