CVE-2025-44136 Cross-site scripting in n/a
An unauthenticated attacker can execute arbitrary JavaScript in a victim's browser via reflected XSS in the layer parameter of MapTiler Tileserver-php.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-44136?
CVE-2025-44136 is a critical cross-site scripting vulnerability in n/a, published on 29 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
Weakness: CWE-79
Which versions are affected by CVE-2025-44136?
It affects 1 product.
Products include Maptiler Tileserver Php.
How do I fix CVE-2025-44136?
No fix has been published for CVE-2025-44136 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-44136 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-44136 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cj86-6g7w-75f6.