MapServer CVE-2026-54354

Requires a MapServer LAYER with CONNECTIONTYPE POSTGIS whose filter/ID item is configured as numeric via metadata (e.g. gml_<item>_type=Integer), and that layer must be reachable through a query endpoint that accepts attacker-controlled input - either the CGI qstring filter or an OGC API Features featureId path segment. Exploitation is unauthenticated (PR:N) and needs no user interaction, but is gated to affected versions 8.4.0 through 8.6.3; layers using non-numeric items, non-PostGIS connections, or without the numeric metadata are not affected by this specific unquoted-concatenation path. Full data extraction relies on blind (boolean/time-based) inference since the flaw does not itself enable database modification.

This is a genuine, higher-priority issue rather than a paper-tiger high-CVSS. The vendor CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) describes a network-reachable, unauthenticated, low-complexity SQL injection (CWE-89) - the most weaponizable class of web flaw - and I largely agree with it. The impact profile is honest: C:H reflects full data exfiltration achievable via boolean/time-based blind injection, I:N correctly captures that the vendor states no database modification is established, and A:L reflects increased DB load rather than a full outage. No EPSS/KEV/POC/SSVC signals were provided: exploitation status is 'no public exploit identified at time of analysis,' so this is not confirmed in-the-wild activity. The one material caveat the raw CVSS score hides is a configuration gate - exploitation requires a PostGIS-backed layer with numeric-type metadata (e.g. gml_<item>_type=Integer) exposed on a query endpoint - which narrows the real-world attack surface below what an unqualified 8.2 implies. Net: treat as a real priority for anyone running MapServer PostGIS layers behind CGI/OGC API Features, patch promptly, but recognize exploitation is conditional on that specific layer configuration.

An unauthenticated attacker locates a MapServer OGC API Features (or classic CGI) endpoint backed by a CONNECTIONTYPE POSTGIS layer whose ID/filter item is declared numeric (gml_gid_type=Integer). Instead of a numeric featureId or qstring value, they supply a non-numeric SQL fragment, which is concatenated unquoted into the generated PostgreSQL predicate, enabling predicate bypass and boolean-/time-based blind SQL injection to enumerate unintended records. No public exploit code was provided in the intelligence, though the fixing PR (#7516) ships a regression test demonstrating the invalid-input path.