MapServer versions 6.0 up to (but not including) 8.6.2 contain a reflected XSS flaw that enables an unauthenticated attacker to inject arbitrary HTML or JavaScript into the browser of any user who opens a crafted WMS URL. The flaw is triggered when the request uses FORMAT=application/openlayers in conjunction with an unsanitized SRS parameter in a WMS 1.3.0 request. This weakness falls under CWE‑80 and can allow a malicious actor to hijack sessions, deface content, or exfiltrate data from the victim’s browser.

The affected product is MapServer, specifically all releases from 6.0 up through 8.6.1. Version 8.6.2 and later contain the fix and are not vulnerable.

The CVSS score of 6.1 indicates moderate severity, while no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires only that a user visits a crafted URL, the likelihood of exploitation remains significant for exposed WMS services that still allow the problematic FORMAT parameter and accept unauthenticated requests. Operators can mitigate risk by disabling or sanitizing the openlayers format or by restricting access to trusted networks.