maptiler/tileserver-php

GitHub

github.com

tileserver.maptiler.com

Releases3

Frequency1 year 2 weeks

Last Release about 10 years ago

Stars592

MBTiles and MapTiler folder hosting with TileJSON, OGC WMTS, UTFGrid interaction and web interface. QGIS & ESRI ArcGIS compatible. Runs on any Apache+PHP webhosting. MapBox Studio Vector Tiles hosting.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-44136 ↗	Jul 29, 2025Tuesday, 29 July 2025, 17:15	9.8 CRITICAL	—
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
CVE-2025-44137 ↗	Jul 29, 2025Tuesday, 29 July 2025, 17:15	8.2 HIGH	—
MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"