CVE-2026-54354: MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation
MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml<item>type=Integer are configured, but it does not verify that attacker-controlled CGI qstring or OGC API Features featureId input is a numeric literal. The unquoted input is concatenated into the generated PostgreSQL/PostGIS predicate, allowing an unauthenticated remote attacker with access to an affected query endpoint to bypass predicates, enumerate unintended records, perform boolean-based or time-based SQL injection, and increase database load. The issue does not by itself establish database modification capabilities. This issue is fixed in version 8.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MapServerto a version that resolves this vulnerability.Fixed in 8.6.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use MapServer before 8.6.4 with CONNECTIONTYPE POSTGIS and a runtime query endpoint accessible to an attacker. Exposure depends on metadata that causes a filter item to be treated as an Integer, such as gml_<item>_type=Integer.
What access does an attacker need to exploit it?
An attacker needs unauthenticated remote access to an affected query endpoint and must be able to supply a CGI qstring or OGC API Features featureId value for the affected numeric filter item. No privileges or user interaction are required.
What can exploitation achieve?
An attacker can inject SQL into the generated PostgreSQL/PostGIS predicate to bypass filters, enumerate unintended records, and conduct boolean-based or time-based injection. The issue can also increase database load, but the available information does not establish database modification capability.
How can I remediate the issue?
Upgrade MapServer to version 8.6.4, which fixes the issue. Until upgrading, restrict access to affected runtime query endpoints and avoid configurations that classify attacker-controlled filter items as numeric without validation.