CVE-2025-44136

Description

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.

Reserved 2025-04-22 | Published 2025-07-29 | Updated 2025-07-29 | Assigner mitre

References

github.com/maptiler/tileserver-php/issues/167

github.com/mheranco/CVE-2025-44136

cve.org (CVE-2025-44136)

nvd.nist.gov (CVE-2025-44136)

Download JSON