CVE-2025-59431
MapServer - WFS XML Filter Query SQL injection
Summary
MapServer - WFS XML Filter Query SQL injection
Original description
The description as published by the source.
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-59431 mapserver Fixed in: 7.6.2-1+deb11u1
- Ubuntu UBUNTU-CVE-2025-59431 mapserver
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov