EUVD-2026-82431Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Unauthenticated network SQLi over an exposed query endpoint (AV:N/PR:N/UI:N); blind injection yields full read (C:H), no modification stated (I:N), and only added DB load (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml_<item>_type=Integer are configured, but it does not verify that attacker-controlled CGI qstring or OGC API Features featureId input is a numeric literal. The unquoted input is concatenated into the generated PostgreSQL/PostGIS predicate, allowing an unauthenticated remote attacker with access to an affected query endpoint to bypass predicates, enumerate unintended records, perform boolean-based or time-based SQL injection, and increase database load. The issue does not by itself establish database modification capabilities. This issue is fixed in version 8.6.4.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in MapServer 8.4.0 through 8.6.3 lets remote attackers who can reach a PostGIS-backed query endpoint inject arbitrary SQL fragments into the generated PostgreSQL predicate, bypassing record-level filters and enumerating data they should not see. The flaw is reachable via the CGI qstring filter or an OGC API Features featureId path segment when a layer is configured with CONNECTIONTYPE POSTGIS and numeric item metadata such as gml_<item>_type=Integer; the unquoted value is concatenated straight into the SQL statement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a MapServer LAYER with CONNECTIONTYPE POSTGIS whose filter/ID item is configured as numeric via metadata (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, higher-priority issue rather than a paper-tiger high-CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to MapServer 8.6.4, which is the vendor-released patch; the fix is documented in the GitHub security advisory GHSA-xp29-8wp5-wc3p, delivered via pull request #7516 and commits 65f1b53c258df2abdf6ce1f437c29e75e9976247 and bd59d49779d2ecc64ca8dc1281c53231a50b698e, and shipped in release tag rel-8-6-4 (changelog at mapserver.org/development/changelog/changelog-8-6.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MapServer instances running versions 8.4.0 through 8.6.3, especially those with PostGIS-backed layers or internet-facing CGI endpoints, and apply the vendor patch immediately; if patching is delayed, disable the CGI qstring filter and OGC API Features featureId path segments, or restrict access to trusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today