CVE-2026-42030: OSGeo MapServer WMS XSS Vulnerability

CVE-2026-42030 Overview

CVE-2026-42030 is a reflected Cross-Site Scripting (XSS) vulnerability in MapServer, an open-source platform for developing web-based Geographic Information System (GIS) applications. The flaw resides in MapServer's Web Map Service (WMS) server and affects versions from 6.0 up to but not including 8.6.2. An unauthenticated attacker can inject arbitrary HTML or JavaScript into a victim's browser by crafting a malicious WMS URL. Exploitation requires the victim to open the attacker-supplied link. The vulnerability is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page and was patched in MapServer 8.6.2.

Critical Impact

Successful exploitation enables session hijacking, credential theft, and arbitrary script execution within the trusted origin of the MapServer WMS endpoint.

Affected Products

• OSGeo MapServer versions 6.0 through 8.6.1
• MapServer WMS 1.3.0 server endpoints handling the FORMAT=application/openlayers parameter
• MapServer deployments exposing WMS endpoints to untrusted clients

Discovery Timeline

• 2026-05-08 - CVE-2026-42030 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-42030

Vulnerability Analysis

The vulnerability stems from improper sanitization of the SRS (Spatial Reference System) parameter in WMS 1.3.0 requests. When a client requests FORMAT=application/openlayers, MapServer generates an HTML page embedding an OpenLayers viewer. The server reflects the user-supplied SRS parameter directly into the response HTML without encoding it as safe output. An attacker who controls the URL can therefore inject markup that executes in the victim's browser.

Because the vulnerable endpoint is part of the public WMS interface, no authentication is required to trigger the reflection. The attacker only needs to convince a target to click a crafted link or load it through an embedded resource. The scope changes because injected script runs in the security context of the MapServer origin, granting access to cookies, tokens, and DOM state for that domain.

Root Cause

The root cause is missing output encoding on the SRS parameter when the WMS response is rendered with the application/openlayers format. MapServer trusts the value passed in the query string and concatenates it into HTML used to build the viewer template. This pattern matches [CWE-80], where script-related HTML tags pass through unfiltered.

Attack Vector

The attack vector is network-based and relies on user interaction. An attacker crafts a URL targeting a legitimate MapServer WMS endpoint with parameters such as SERVICE=WMS, VERSION=1.3.0, REQUEST=GetMap, FORMAT=application/openlayers, and an SRS value containing a JavaScript payload. The victim's browser renders the reflected payload, executing attacker-controlled script under the MapServer origin. See the GitHub Security Advisory GHSA-4g9f-ph64-hg2x for full technical details.

Detection Methods for CVE-2026-42030

Indicators of Compromise

• WMS request logs containing FORMAT=application/openlayers together with SRS values that include angle brackets, script, javascript:, onerror=, or URL-encoded equivalents (%3C, %3E)
• HTTP referrers pointing to untrusted domains for requests reaching the MapServer WMS endpoint
• Unusual spikes in GetMap requests with abnormally long or malformed SRS parameter values

Detection Strategies

• Inspect web server access logs for WMS 1.3.0 requests combining the OpenLayers format with non-standard SRS values that do not match expected EPSG codes such as EPSG:4326 or EPSG:3857
• Deploy Web Application Firewall (WAF) rules that flag HTML or JavaScript metacharacters within WMS query parameters
• Correlate browser-side Content Security Policy (CSP) violation reports with MapServer endpoint URLs to surface attempted injections

Monitoring Recommendations

• Forward MapServer and reverse proxy access logs to a centralized SIEM and alert on anomalous SRS parameter content
• Monitor outbound traffic from end-user browsers to detect exfiltration triggered by injected scripts loading external resources
• Track the MapServer version banner in deployment inventory to verify all instances are running 8.6.2 or later

How to Mitigate CVE-2026-42030

Immediate Actions Required

• Upgrade MapServer to version 8.6.2 or later on all servers exposing WMS endpoints
• Audit reverse proxies and CDNs in front of MapServer to confirm WMS query parameters are inspected and constrained
• Notify users and administrators to avoid clicking untrusted WMS URLs until patching is complete

Patch Information

The MapServer maintainers fixed the issue in release 8.6.2. Refer to the MapServer 8.6.2 release notes and the GitHub Security Advisory GHSA-4g9f-ph64-hg2x for upgrade instructions and patch commits. Operators running source builds should pull the rel-8-6-2 tag and rebuild against the same dependency versions used in production.

Workarounds

• Disable the application/openlayers output format in MapServer configuration if it is not required for production workloads
• Restrict access to the WMS endpoint with network-level controls or authenticated reverse proxies until the patch is applied
• Deploy a strict Content Security Policy (CSP) header that disallows inline script execution on the MapServer origin to reduce exploitability

# Configuration example: block the vulnerable format at the reverse proxy (nginx)
location /cgi-bin/mapserv {
    if ($arg_format ~* "application/openlayers") {
        return 403;
    }
    if ($arg_srs ~* "[<>\"']|script|javascript:") {
        return 400;
    }
    proxy_pass http://mapserver_backend;
}