VulnerabilityAnalyzed
CVE-2025-44136
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS).
CRITICAL 9.8EPSS 2.51%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.51% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- maptiler/tileserver php
- Source
- cve@mitre.org
References
- https://github.com/maptiler/tileserver-php/issues/167Exploit, Issue Tracking
- https://github.com/mheranco/CVE-2025-44136Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.