Directory Traversal Vulnerability in MapTiler Tileserver-php
CVE-2025-44137

8.2HIGH

Key Information:

Vendor

MapTiler

Status
Tileserver-php
Vendor
CVE Published:
29 July 2025

What is CVE-2025-44137?

MapTiler Tileserver-php version 2.0 has a Directory Traversal vulnerability through its renderTile function in tileserver.php. This issue allows attackers to manipulate file paths using '../' sequences, potentially enabling unauthorized access to sensitive files stored on the web server. The vulnerability is triggered via specific GET parameters: 'TileMatrix', 'TileRow', 'TileCol', and 'Format'. Proper input validation and sanitization are essential to mitigate the risks posed by this flaw.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/maptiler/tileserver-php/issues/167
https://github.com/mheranco/CVE-2025-44137
https://github.com/maptiler/tileserver-php/commit/4fe14e6...

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.