MapServer EUVD-2026-28807

The vulnerability requires specific conditions: (1) WMS 1.3.0 request must be sent to MapServer (WMS version specification); (2) FORMAT parameter must be set to application/openlayers (specific content type); (3) SRS parameter must contain attacker-controlled, unsanitized payload; (4) user must click a crafted WMS URL or the URL must be embedded in a page that automatically loads the WMS request. Exploitation does NOT require authentication (PR:N in CVSS vector), does NOT require special server configuration (WMS is enabled by default), and does NOT require the attacker to have direct access to the MapServer instance. However, exploitation is limited by the requirement that a user must interact with the malicious link (UI:R), meaning unsuspecting users who receive phishing emails or visit malicious pages are the attack vector. Default MapServer deployments with public WMS endpoints are vulnerable.

CVSS 6.1 (Medium) reflects network vector with low complexity and no authentication required, but critically requires user interaction (UI:R) and only causes limited confidentiality and integrity impact (C:L/I:L). The CVSS vector indicates reflected XSS rather than stored XSS or RCE. While the network accessibility is high and attack complexity is low, real-world risk depends heavily on whether MapServer instances are exposed to untrusted networks and whether users can be socially engineered to click malicious links. The vulnerability is not listed as actively exploited (no CISA KEV status provided), and no public POC has been identified. The scoped impact (S:C) suggests the attack may affect other security domains (e.g., session hijacking, credential theft). For organizations running public WMS services, this poses a moderate risk to end users; for internal or restricted deployments, risk is lower. The fact that vendor released an immediate patch (8.6.2) and explicitly advised all users to upgrade suggests vendor severity assessment was moderate to high.

An attacker crafts a WMS URL containing malicious JavaScript in the SRS parameter with FORMAT=application/openlayers, e.g., http://vulnerable-mapserver/wms?SERVICE=WMS&VERSION=1.3.0&REQUEST=GetMap&FORMAT=application/openlayers&SRS=%27%3Csvg/onload=alert('XSS')%3E. The attacker shares this URL via email, forum post, or malicious website. When a user clicks the link, MapServer renders the unsanitized SRS parameter into the OpenLayers HTML template, executing the attacker's JavaScript in the user's browser with the privileges of the MapServer origin, allowing cookie theft, session hijacking, or further attacks against the mapping application.