CVE-2025-59431 is a critical (CVSS 9.8) SQL injection in OSGeo MapServer before 8.4.1. The PropertyName value in an XML filter query can bypass expression checking and alter backend database queries. Upgrade to 8.4.1. The sections below cover who is affected, how to check, and what to do now.
What's affected
From the NVD record and GitHub advisory GHSA-256m-rx4h-r55w, MapServer versions before 8.4.1 are affected, and the fix is in 8.4.1. The affected feature is the XML Filter Query directive, specifically its PropertyName element.
The advisory page was not available through the GitHub API when I checked, so the details come from the record.
How to check if you're exposed
Check the MapServer version on each host:
mapserv -v
map2img -v
If the output shows a version below 8.4.1, you are in range. Then see whether any of your map files use a database connection, such as PostGIS, and whether OGC services like WFS are exposed to the internet. Those are the paths where filter queries arrive. In a container, check the image tag as well as the host.
What to do now
- Upgrade MapServer to 8.4.1 or later and rebuild any images that bundle it.
- Confirm which data layers use a SQL backed connection.
- Reduce the database account used by MapServer to read only access on the tables it serves.
- Review web server logs for unusual filter requests with odd quoting in PropertyName.
- Consider whether WFS and other OGC endpoints need to be public at all.
Why it matters
The record maps this to CWE-89, SQL injection. According to the description, expression checking is bypassed by introducing double quote characters in PropertyName, which allows manipulation of backend database queries. The class is boolean based, meaning an attacker learns data one yes or no answer at a time from how the service responds.
That style is slow but quiet and it still extracts whole tables. The vector shows network access with no privileges and high impact on all three properties, which is why the score is 9.8. It is not on the CISA KEV list, and the record has no exploitation information.
SQL injection happens when input reaches a database query as part of its structure instead of as plain data. The reliable defence is the same everywhere: parameterised queries or prepared statements, and no string building for anything a user can influence. Input validation helps, but it is a second line, not the first.
If you find injectable code in your own applications, treat the fix as two jobs. Change the query so the value is bound as a parameter, and check the database account the application uses. An account that can only read the tables it needs turns a bad bug into a smaller one.
Safeguard can help you find this one in your own software. The free in-browser dependency scan at gold.safeguard.sh/scan reads your manifest or lockfile and shows which known vulnerabilities your declared dependencies carry, including transitive ones. Reachability analysis then helps you separate the places where your code actually calls the affected component from the places where it only sits in the tree, which makes it easier to decide what to patch first.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-59431?
MapServer 8.4.1.
What does boolean based mean?
The attacker infers data from true or false differences in responses rather than reading query results directly.
Sources
- GitHub advisory GHSA-256m-rx4h-r55w (listed in the record)
- NVD record data
Last reviewed: 18 October 2026.
