CVE-2009-0842: OSGeo Mapserver

Medium severity, CVSS 4.3. EPSS: 2.6% chance of exploitation in the next 30 days.

mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers the display of partial file contents within an error message, as demonstrated by a /tmp/sekrut.map symlink.

Affected products

• OSGeo Mapserver: version 4.2.0 only; version 4.4.0 only; version 4.6.0 only; version 4.8.0 only; version 4.10.0 only; version 4.10.1 only; …
• Umn Mapserver: version 4.0 only

Published 2009-03-31. Last modified 2026-06-16.