Is CVE-2026-42030 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42030 being exploited in the wild.

How severe is CVE-2026-42030?

Medium severity, with a CVSS score of 6.1, published 8 May 2026.

Is there a fix for CVE-2026-42030?

A patch was published on 2026-04-19: Version 8.6.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42030 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42030?

Check whether you run MapServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42030: MapServer reflected XSS in WMS server SRS parameter

CVE-2026-42030 · Severity: medium · CVSS 6.1 · Published 2026-05-08

MapServer, a platform for building web-based geographic information system (GIS) applications, contains a security flaw in its map-rendering service. An attacker can create a malicious link that, if clicked by a user, executes unauthorized code in that user's web browser. This could allow an attacker to steal session information, impersonate the user, or modify the content of the web page the user is viewing.

Technologies: MapServer. Vendors: MapServer.

Quick answers

Is CVE-2026-42030 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42030 being exploited in the wild.
How severe is CVE-2026-42030?: Medium severity, with a CVSS score of 6.1, published 8 May 2026.
Which products and versions are affected?: MapServer 6.0 to 8.6.1.
Is there a fix for CVE-2026-42030?: A patch was published on 2026-04-19: Version 8.6.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42030 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42030?: Check whether you run MapServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in MapServer's Web Map Service (WMS) implementation. The root cause is the improper neutralization of the 'SRS' parameter in WMS 1.3.0 requests when the 'FORMAT' is set to 'application/openlayers'. While WMS 1.1.x correctly validates this parameter, WMS 1.3.0 reflects the unsanitized input directly into the generated OpenLayers HTML template. An unauthenticated remote attacker can exploit this by tricking a user into clicking a specially crafted URL, leading to arbitrary JavaScript execution in the context of the victim's browser session. The issue is resolved in MapServer version 8.6.2.

Affected products

MapServer MapServer 6.0 to 8.6.1

Timeline

2026-04-19: patched: Version 8.6.2 released
2026-04-19: advisory: GitHub Security Advisory published
2026-05-08: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.