mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00331.

Exploitation poc

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
mapfish mapfish-print affected
Version Status Constraints
>= 3.0.0, < 3.28.30 affected —
>= 3.29.0, < 3.30.32 affected —
>= 3.31.0, < 3.31.24 affected —
>= 3.32.0, < 3.33.16 affected —
>= 4.0.0, < 4.0.5 affected —
mapfish org.mapfish.print.print-lib affected
Version Status Constraints
>= 3.0.0, < 3.28.30 affected —
>= 3.29.0, < 3.30.32 affected —
>= 3.31.0, < 3.31.24 affected —
>= 3.32.0, < 3.33.16 affected —
>= 4.0.0, < 4.0.5 affected —
mapfish org.mapfish.print.print-servlet affected
Version Status Constraints
>= 3.0.0, < 3.28.30 affected —
>= 3.29.0, < 3.30.32 affected —
>= 3.31.0, < 3.31.24 affected —
>= 3.32.0, < 3.33.16 affected —
>= 4.0.0, < 4.0.5 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Mapfish Subscribe
Mapfish-print Subscribe
Org.mapfish Subscribe
Print.print-lib Subscribe
Print.print-servlet Subscribe

Project Subscriptions

Vendors Products
Mapfish Subscribe
Mapfish-print Subscribe
Org.mapfish Subscribe
Print.print-lib Subscribe
Print.print-servlet Subscribe
Advisories
Source ID Title
Github GHSA Github GHSA GHSA-5v29-34h8-v68r MapFish Print has XXE that allows reading arbitrary files of certain types
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec cve-icon cve-icon
https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb cve-icon cve-icon
https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d cve-icon cve-icon
https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/pull/4212 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/pull/4215 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/pull/4216 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/pull/4217 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/pull/4219 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/pull/4221 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/releases/tag/3.28.30 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/releases/tag/3.30.32 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/releases/tag/3.31.24 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/releases/tag/4.0.5 cve-icon cve-icon
https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r cve-icon cve-icon cve-icon
History

Tue, 01 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Mapfish
Mapfish mapfish-print
Org.mapfish
Org.mapfish print.print-lib
Org.mapfish print.print-servlet
Vendors & Products Mapfish
Mapfish mapfish-print
Org.mapfish
Org.mapfish print.print-lib
Org.mapfish print.print-servlet

Mon, 31 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Description mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.
Title mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types
Weaknesses CWE-611
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-31T14:10:14.891Z

Reserved: 2026-06-17T16:44:40.994Z

Link: CVE-2026-55848

cve-icon Vulnrichment

Updated: 2026-08-31T14:07:28.992Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T23:17:08.013

Modified: 2026-09-09T21:09:13.080

Link: CVE-2026-55848

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:00:03Z

Weaknesses