CVE-2026-54354

Name of the Vulnerable Software and Affected Versions MapServer versions prior to 8.6.4

Description MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and the msPostGISLayerTranslateFilter() function fails to verify that input from the CGI qstring or OGC API Features featureId is a numeric literal when CONNECTIONTYPE POSTGIS and metadata such as gml <item> type=Integer are configured. This allows an unauthenticated remote attacker to inject unquoted input into the generated PostgreSQL/PostGIS predicate. This can lead to predicate bypass, enumeration of unintended records, boolean-based or time-based SQL injection, and increased database load, although it does not allow for database modification.

Recommendations Update to version 8.6.4.