Quick answers
- Is CVE-2026-54354 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54354 being exploited in the wild.
- How severe is CVE-2026-54354?
- High severity, with a CVSS score of 8.2, published 17 September 2026.
- Which products and versions are affected?
- MapServer prior to 8.6.4.
- Is there a fix for CVE-2026-54354?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-54354 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-54354?
- Check whether you run MapServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
MapServer's PostGIS runtime filter translator (msPostGISLayerTranslateFilter in src/mappostgis.cpp) fails to validate that CGI query parameters or OGC API Features featureId values are numeric literals when the metadata declares a filter item as Integer type. Attacker-controlled input is concatenated directly into the PostgreSQL predicate without quoting, enabling SQL injection. An unauthenticated remote attacker with network access to an affected query endpoint can exploit this to bypass predicates, enumerate unintended database records, perform boolean-based or time-based SQL injection, and increase database load. The vulnerability does not directly enable database modification. This issue is fixed in version 8.6.4 (commits 65f1b53 and bd59d49).
Affected products
- MapServer MapServer prior to 8.6.4
Timeline
- 2026-09-17: disclosed