Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54355— MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`

Quick assessment

Affected
MapServer MapServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MapServer 是一个用于开发基于 Web 的 GIS 应用的系统。从 6.0 版本到 8.6.4 版本（含），MapServer 在处理 请求并生成 OpenLayers HTML 输出时，会通过 、 以及 和 中的 替换机制，将攻击者可控的 （通过 接收）直接插入到 JavaScript 的单引号字符串中，且未进行转义。 当部署环境信任该转发行，且未配置固定的 或 值时，攻击者可通过在头文件中嵌入单引号，从而逃逸出生成的 URL 字符串。未经身份验证的攻击者可以构造一个 URL，当受害者打开该 URL 时，

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1059.007 · JavaScript
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54355

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`
Source: CVE Program / CVE List V5
Vulnerability Description
MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FORWARDED_HOST through msBuildOnlineResource(), processLine(), and the [mapserv_onlineresource] substitution in src/maputil.c and src/maptemplate.c without escaping it for a single-quoted JavaScript string. When the deployment trusts the forwarded header and does not configure a fixed ows_onlineresource or MS_ONLINERESOURCE value, embedded single quotes can escape the generated URL string. An unauthenticated attacker can craft a URL that executes arbitrary JavaScript in the MapServer site origin when opened by a victim, enabling access to sessions or tokens, same-origin data and requests, and actions as the victim. This issue is fixed in version 8.6.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MapServer MapServer >= 6.0, < 8.6.4 -

II. Public POCs for CVE-2026-54355

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54355

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54355 (4)

Vendor Advisories for CVE-2026-54355 (1)

Vendor Pages for CVE-2026-54355 (2)

IV. Related Vulnerabilities

Same product: MapServer
Same vendor: MapServer
Same weakness: CWE-79

V. Comments for CVE-2026-54355

No comments yet

Leave a comment