CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

XML External Entity (XXE) Injection

Overview org.mapfish.print:print-lib is a component of MapFish for printing templated cartographic maps. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the GML layer processing of the print report endpoint buildreport.pdf, which parses GML XML without...

GHSA-5V29-34H8-V68R MapFish Print has XXE that allows reading arbitrary files of certain types

Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs. https://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507 Details To trigger the XXE it is required to host a remote script and dtd file. When using...

MapFish Print has XXE that allows reading arbitrary files of certain types

Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs. https://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507 Details To trigger the XXE it is required to host a remote script and dtd file. When using...

CVE-2026-55848

MapFish Print (a component of the MapFish cartographic printing platform) is vulnerable to XML External Entity (XXE) injection in versions prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5. The vulnerability exists in the /api/print3/print endpoint, where an attacker-controlled GML layer URL...

CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

PT-2026-83371

Name of the Vulnerable Software and Affected Versions mapfish-print versions prior to 3.28.30 mapfish-print versions prior to 3.30.32 mapfish-print versions prior to 3.31.24 mapfish-print versions prior to 3.33.16 mapfish-print versions prior to 4.0.5 Description MapFish Print fails to disable...