MapServer CVE-2026-54355

Exploitation requires a specific non-default deployment: the MapServer instance must trust the forwarded HTTP_X_FORWARDED_HOST header AND must NOT configure a fixed ows_onlineresource metadata value or MS_ONLINERESOURCE environment variable - when either is pinned, the attacker-controlled host is not reflected and the flaw does not trigger. The vulnerable endpoint is specifically the OpenLayers HTML output (SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers), where the value flows through msBuildOnlineResource()/processLine() and the [mapserv_onlineresource] substitution into a single-quoted JavaScript string without escaping. Exploitation is further limited by required user interaction (a victim must open the crafted link, UI:P) though no authentication is needed (PR:N); impact is confined to the victim's browser session in the MapServer origin, not the server itself.

This is a reflected cross-site scripting (CWE-79) flaw in MapServer's OpenLayers HTML output, and the signals point to a moderate, conditionally-exploitable issue rather than a top priority. The vendor CVSS 4.0 score is 5.3 (medium), with AV:N/AC:L but critically AT:P (a specific attack requirement) and UI:P (passive user interaction) - meaning exploitation depends on both a non-default configuration and a victim opening the attacker's link. The impact metrics tellingly place all vulnerable-system impacts at N (VC:N/VI:N/VA:N) and shift harm to the subsequent (browser) system (SC:H/SI:H), which is the correct modeling for XSS: MapServer itself is not compromised; the victim's session in the site origin is. No EPSS score, CISA KEV listing, or public exploit is present in the provided data, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' However, the fix PR ships a concrete regression test that injects HTTP_X_FORWARDED_HOST="with'single'quote" and greps for the unescaped reflection, which effectively documents the exact trigger and lowers the bar for a researcher to reproduce it. The dominant risk-limiting factor is the configuration gate: the header must be trusted and no fixed ows_onlineresource / MS_ONLINERESOURCE is set. Where that gate is open, unauthenticated reflected XSS against a GIS front-end is a real credential/session-theft vector.

An attacker crafts a malicious GetMap URL (SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers) and lures a logged-in MapServer user into opening it, supplying a poisoned X-Forwarded-Host header (or relying on a proxy that forwards it) whose embedded single quotes break out of the generated JavaScript URL string. When rendered, arbitrary JavaScript executes in the MapServer site origin, allowing theft of session cookies/tokens and same-origin actions as the victim. No public exploit is identified, but the vendor's fix PR includes a regression test demonstrating the exact unescaped reflection.