{"id":59872,"date":"2025-08-04T12:50:53","date_gmt":"2025-08-04T12:50:53","guid":{"rendered":""},"modified":"2025-10-21T03:36:19","modified_gmt":"2025-10-21T09:36:19","slug":"cve-2025-44136-critical-cross-site-scripting-vulnerability-in-maptiler-tileserver-php-v2-0","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-44136-critical-cross-site-scripting-vulnerability-in-maptiler-tileserver-php-v2-0\/","title":{"rendered":"<strong>CVE-2025-44136: Critical Cross Site Scripting Vulnerability in MapTiler Tileserver-php v2.0<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>Cybersecurity is a field that is constantly evolving with new vulnerabilities being discovered on a daily basis. One such vulnerability is the CVE-2025-44136, a high-risk Cross Site Scripting (XSS) vulnerability found in MapTiler Tileserver-php v2.0. This <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-45346-sql-injection-vulnerability-in-bacula-web-resulting-in-potential-system-compromise\/\"  data-wpil-monitor-id=\"68043\">vulnerability can have severe implications including potential system<\/a> compromise and data leakage. Considering the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5039-critical-vulnerability-in-autodesk-applications-leading-to-arbitrary-code-execution\/\"  data-wpil-monitor-id=\"90524\">critical role that MapTiler Tileserver plays in various applications<\/a>, it is important to understand the nature of this vulnerability and the steps that can be taken to mitigate it.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-44136<br \/>\nSeverity: Critical with a CVSS score of 9.8<br \/>\nAttack Vector: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-46198-cross-site-scripting-vulnerability-in-grav-versions-1-7-46-to-1-7-48\/\"  data-wpil-monitor-id=\"69848\">Cross Site Scripting<\/a> (XSS) via GET parameter<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: Required<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-7027-critical-firmware-vulnerability-enabling-arbitrary-memory-writes-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"69849\">System compromise and potential<\/a> data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-961365322\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 720px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 22px; font-weight: 600; display: flex; align-items: center; letter-spacing: -0.02em;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 10px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 42px; height: 42px;\" \/>\r\n    <\/a>\r\n    Share secrets securely\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 14px; color: #d1d5db;\">\r\n    Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 18px; color: #a1a1aa;\">\r\n    Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 24px; color: #e4e4e7;\">\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Encrypted identity<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Private Spaces for organizations and teams<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 End-to-end encrypted chat, calls, files, and notes<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Sensitive AI work and protected collaboration<\/li>\r\n    <li>\u2022 Built for information that cannot leak<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px; color: #ffffff;\">\r\n    Our mission is to secure human work alongside AI.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 8px; font-weight: 500;\">\r\n      Download Ameeba\r\n    <\/a>\r\n\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 8px; font-weight: 500;\">\r\n      Learn More\r\n    <\/a>\r\n  <\/div>\r\n<\/div><\/div>\n<p>Product | Affected Versions<\/p>\n<p>MapTiler Tileserver-php | v2.0<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-44137-directory-traversal-vulnerability-in-maptiler-tileserver-php-v2-0\/\"  data-wpil-monitor-id=\"71539\">vulnerability lies in the GET parameter &#8220;layer&#8221; of MapTiler Tileserver-php<\/a> v2.0. This parameter is reflected in an error message without HTML encoding, making it <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-53084-critical-cross-site-scripting-vulnerability-in-wwbn-avideo-14-4\/\"  data-wpil-monitor-id=\"68042\">vulnerable to Cross Site Scripting<\/a> (XSS) attacks. Essentially, an unauthenticated attacker can manipulate the &#8220;layer&#8221; GET parameter to <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-54451-code-injection-vulnerability-in-samsung-electronics-magicinfo-9-server\/\"  data-wpil-monitor-id=\"68044\">inject malicious JavaScript or HTML code<\/a>. When a victim views the error message, the malicious <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26074-remote-code-execution-vulnerability-in-orkes-conductor-v3-21-11\/\"  data-wpil-monitor-id=\"68046\">code executes<\/a>, potentially leading to system compromise or data leakage.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-685417470\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Below is a conceptual example of how the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-8243-critical-buffer-overflow-vulnerability-in-totolink-x15-http-post-request-handler\/\"  data-wpil-monitor-id=\"68045\">vulnerability might be exploited using an HTTP GET request<\/a>:<\/p>\n<pre><code class=\"\" data-line=\"\">GET \/tileserver.php?layer=&lt;img src=x onerror=alert(&#039;XSS&#039;)&gt; HTTP\/1.1\nHost: vulnerable.example.com<\/code><\/pre>\n<p>In this example, the malicious payload is an HTML image tag with a JavaScript &#8216;onerror&#8217; event handler. When the image fails to load, which it does because &#8216;x&#8217; is not a valid source, the JavaScript code within the &#8216;onerror&#8217; event handler (alert(&#8216;XSS&#8217;)) is executed.<\/p>\n<p><strong>Mitigation Guidance<\/strong><\/p>\n<p>Users of MapTiler Tileserver-php v2.0 are advised to apply the vendor patch as soon as it becomes available. In the meantime, use of Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) can serve as a temporary mitigation. These systems can be configured to detect and block attempts to exploit this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-36845-server-side-request-forgery-ssrf-vulnerability-in-eveo-urve-web-manager\/\"  data-wpil-monitor-id=\"70668\">vulnerability by looking for known malicious patterns in HTTP requests<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview Cybersecurity is a field that is constantly evolving with new vulnerabilities being discovered on a daily basis. One such vulnerability is the CVE-2025-44136, a high-risk Cross Site Scripting (XSS) vulnerability found in MapTiler Tileserver-php v2.0. This vulnerability can have severe implications including potential system compromise and data leakage. Considering the critical role that MapTiler [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[81],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-59872","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-xss"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=59872"}],"version-history":[{"count":5,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59872\/revisions"}],"predecessor-version":[{"id":83469,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/59872\/revisions\/83469"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=59872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=59872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=59872"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=59872"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=59872"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=59872"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=59872"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=59872"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=59872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}