CVE-2009-0841: OSGeo Mapserver

High severity, CVSS 10.0. EPSS: 5.3% chance of exploitation in the next 30 days.

Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.

Affected products

• OSGeo Mapserver: version 4.2.0 only; version 4.4.0 only; version 4.6.0 only; version 4.8.0 only; version 4.10.0 only; version 4.10.1 only; …
• Umn Mapserver: version 4.0 only

Published 2009-03-31. Last modified 2026-06-16.