{"id":"CVE-2026-42030","aliases":["DEBIAN-CVE-2026-42030","EUVD-2026-28807","GHSA-4g9f-ph64-hg2x","UBUNTU-CVE-2026-42030"],"status":"published","title":"MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer","description":"MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00247,"percentile":0.16102,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-80"],"published":"2026-05-08T15:56:48Z","modified":"2026-11-11T20:10:00Z","fixes":[{"ecosystem":"Debian:14","package":"mapserver","fixed_in":["8.6.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.0-3","8.0.0-3+deb12u1","8.0.1-1","8.0.1-1~exp1","8.0.1-2","8.0.1-2.1~exp1","8.0.1-2~bpo12+1","8.0.1-3","8.0.1-3~exp1","8.0.1-4","8.0.1-5","8.0.2-1","8.0.2-1~bpo12+1","8.2.0-1","8.2.0-1~bpo12+1","8.2.0~beta1-1~exp1","8.2.0~beta2-1~exp1","8.2.0~beta3-1~exp1","8.2.0~rc1-1~exp1","8.2.0~rc2-1~exp1","8.2.0~rc3-1~exp1","8.2.1-1","8.2.1-1~bpo12+1","8.2.2-1","8.2.2-1~bpo12+1","8.4.0-1","8.4.0-1~bpo12+1","8.4.0-2","8.4.0-3","8.4.0-4","8.4.0~beta1-1~exp1","8.4.0~beta2-1~exp1","8.4.0~rc1-1~exp1","8.4.1-1","8.4.1-1~bpo13+1","8.4.1-2","8.6.0-1","8.6.0-1~bpo13+1","8.6.0~beta1-1~exp1","8.6.0~beta2-1~exp1","8.6.0~rc1-1~exp1","8.6.1-1","8.6.1-1~bpo13+1","8.6.2-1","8.6.2-1~bpo13+1","8.6.3-1","8.6.3-1~bpo13+1","8.6.4-1","8.6.4-1~bpo13+1","8.6.5-1","8.6.5-1~bpo13+1","8.6.6-1","8.6.6-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-4","8.4.0-4+deb13u1","8.4.0-4+deb13u2","8.4.1-1","8.4.1-1~bpo13+1","8.4.1-2","8.6.0-1","8.6.0-1~bpo13+1","8.6.0~beta1-1~exp1","8.6.0~beta2-1~exp1","8.6.0~rc1-1~exp1","8.6.1-1","8.6.1-1~bpo13+1","8.6.2-1","8.6.2-1~bpo13+1","8.6.3-1","8.6.3-1~bpo13+1","8.6.4-1","8.6.4-1~bpo13+1","8.6.5-1","8.6.5-1~bpo13+1","8.6.6-1","8.6.6-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.2-1"}]}],"versions":["8.4.0-4","8.4.1-1","8.4.1-1~bpo13+1","8.4.1-2","8.6.0-1","8.6.0-1~bpo13+1","8.6.0~beta1-1~exp1","8.6.0~beta2-1~exp1","8.6.0~rc1-1~exp1","8.6.1-1","8.6.1-1~bpo13+1","8.6.2-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-4build1","7.0.0-5ubuntu1","7.0.0-7","7.0.0-8","7.0.0-8build1","7.0.0-9","7.0.0-9ubuntu1","7.0.0-9ubuntu2","7.0.0-9ubuntu3","7.0.0-9ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.6-2build1","7.0.7-1","7.0.7-1build1","7.0.7-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.1-1build1","7.4.1-1build3","7.4.2-1","7.4.2-1build1","7.4.3-1","7.4.3-1build2","7.4.3-2","7.4.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6.3-1~exp1ubuntu1","7.6.4-2","7.6.4-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-2build1","8.0.1-2build2","8.0.1-2build3","8.0.1-2build5","8.0.1-4ubuntu1","8.0.1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-1build1","8.4.0-4","8.4.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.0-1build1","8.6.4-1","8.6.5-1","8.6.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-4build1","8.4.1-1","8.4.1-1build1","8.4.1-2","8.4.1-2build1","8.6.0-1","8.6.0-1build1"]}],"products":[{"vendor":"mapserver","product":"mapserver"},{"vendor":"osgeo","product":"mapserver"}],"references":[{"url":"https://github.com/MapServer/MapServer/security/advisories/GHSA-4g9f-ph64-hg2x","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/MapServer/MapServer/releases/tag/rel-8-6-2","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42030.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42030","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42030","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42030","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42030","title":"MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer","description":"MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.","status":"published","published":"2026-05-08T15:56:48.553Z","modified":"2026-05-08T21:26:45.294Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-28807","description":"MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.","status":"published","published":"2026-05-08T15:56:48Z","modified":"2026-05-08T21:26:45Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:14.089367Z"}],"nvd":[{"id":"CVE-2026-42030","description":"MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.","status":"published","published":"2026-05-08T17:16:31.307Z","modified":"2026-11-11T20:10:00.273Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-80"],"updated_at":"2026-11-11T21:26:15.366289Z"}],"osv":[{"id":"CVE-2026-42030","title":"MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer","description":"MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.","status":"published","published":"2026-05-08T15:56:48.553Z","modified":"2026-11-13T02:30:23.193644418Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-80"],"updated_at":"2026-11-13T02:57:35.943061Z"},{"id":"DEBIAN-CVE-2026-42030","description":"MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.","status":"published","published":"2026-05-08T17:16:31.307Z","modified":"2026-11-12T09:47:26.762220834Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-12T10:16:30.501395Z"},{"id":"UBUNTU-CVE-2026-42030","description":"MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any user who opens a crafted WMS URL. The vulnerability is triggered via FORMAT=application/openlayers combined with an unsanitized SRS parameter in WMS 1.3.0 requests. This issue has been patched in version 8.6.2.","status":"published","published":"2026-05-08T17:16:00Z","modified":"2026-10-17T13:00:05.116573575Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"}]}}