XML External Entity (XXE) Injection

mapfish-print is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper parsing of attacker-controlled XML with external entities and DTDs enabled, which allows an unauthenticated attacker to read local files and perform server-side request forgery SSRF by accessing...