CVE-2025-44136

9.8 criticalEPSS 2.7%

Critical (9.8) in maptiler tileserver php. EPSS 2.7% chance of exploitation in the next 30 days.

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-07-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

maptiler:tileserver_php

References

https://github.com/maptiler/tileserver-php/issues/167
https://github.com/mheranco/CVE-2025-44136

Check your stack JSON