CVE-2026-54355Published
MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-54355 · Microsoft / collected KEV context
cve-program · CVE-2026-54355
- https://github.com/MapServer/MapServer/security/advisories/GHSA-xqj6-vjqr-33vv
- https://github.com/MapServer/MapServer/pull/7517
- https://github.com/MapServer/MapServer/pull/7518
- https://github.com/MapServer/MapServer/commit/edc1033c7963fcffd160d85cf430f49aaf4a1374
- https://github.com/MapServer/MapServer/commit/ff17ef190caaeaa9002ac3d1c7969ec5315c345e
- https://github.com/MapServer/MapServer/releases/tag/rel-8-6-4
- https://mapserver.org/development/changelog/changelog-8-6.html#changelog-8-6
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.