Alerts This Week
Warning Icon 1 1,039
Alerts This Week
Warning Icon 1 1,039

Debian 11 Mapserver DLA-4506-1 Critical SQL Injection Threat

debian lts
Calendar Grey March 23, 2026
Dist Debian Esm H88
Critical vulnerabilities in mapserver on Debian could lead to SQL injection and bypass security measures. Update recommended.
Vulnerabilities were found in mapserver, a CGI-based framework for Internet map services, which could lead to security controls bypass or SQL injection
Topics%20covered

Topics Covered

security advisory SQL Injection critical debian mapserver security controls bypass

Summary

CVE-2021-32062

Due to a logic flaw associated with processing map parameter, it is
possible to specify an arbitrary mapfile that bypasses the
`MS_MAP_NO_PATH` and `MS_MAP_PATTERN` security control checks.

CVE-2025-59431

Alwin Warringa discovered that XML Filter Query directive
`PropertyName` is vulnerably to Boolean-based SQL injection,
allowing to manipulate backend database queries via crafted XML
Filter Query directives.

For Debian 11 bullseye, these problems have been fixed in version
7.6.2-1+deb11u1.

We recommend that you upgrade your mapserver packages.

For the detailed security status of mapserver please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/mapserver

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



Severity
critical
Lowest
Low
Medium
High
Critical

Package: mapserver
Version: 7.6.2-1+deb11u1
CVE ID: CVE-2021-32062 CVE-2025-59431
Debian Bug: 988208

Topics%20covered

Topics Covered

security advisory SQL Injection critical debian mapserver security controls bypass

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here