CVE-2026-54354

{"id": "CVE-2026-54354", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54354", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T14:39:52.709916Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MapServer", "product": "MapServer", "versions": [{"status": "affected", "version": ">= 8.4.0, < 8.6.4"}]}]}], "published": "2026-09-17T21:17:15.260", "references": [{"url": "https://github.com/MapServer/MapServer/commit/65f1b53c258df2abdf6ce1f437c29e75e9976247", "source": "security-advisories@github.com"}, {"url": "https://github.com/MapServer/MapServer/commit/bd59d49779d2ecc64ca8dc1281c53231a50b698e", "source": "security-advisories@github.com"}, {"url": "https://github.com/MapServer/MapServer/pull/7516", "source": "security-advisories@github.com"}, {"url": "https://github.com/MapServer/MapServer/releases/tag/rel-8-6-4", "source": "security-advisories@github.com"}, {"url": "https://github.com/MapServer/MapServer/security/advisories/GHSA-xp29-8wp5-wc3p", "source": "security-advisories@github.com"}, {"url": "https://mapserver.org/development/changelog/changelog-8-6.html#changelog-8-6", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml_<item>_type=Integer are configured, but it does not verify that attacker-controlled CGI qstring or OGC API Features featureId input is a numeric literal. The unquoted input is concatenated into the generated PostgreSQL/PostGIS predicate, allowing an unauthenticated remote attacker with access to an affected query endpoint to bypass predicates, enumerate unintended records, perform boolean-based or time-based SQL injection, and increase database load. The issue does not by itself establish database modification capabilities. This issue is fixed in version 8.6.4."}], "lastModified": "2026-09-24T21:19:05.340", "sourceIdentifier": "security-advisories@github.com"}