Riskcovery

CVE-2026-55848

mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

State
Published
Severity
8.6 High
Published
Aug 28, 2026
Updated
Aug 31, 2026
Reserved
Jun 17, 2026

Read the record on cve.org

Description

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

Scores

CVSSScoreVectorSource
3.18.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

ProductVersions
mapfish-printmapfish
  • >= 3.0.0, < 3.28.30Affected
  • >= 3.29.0, < 3.30.32Affected
  • >= 3.31.0, < 3.31.24Affected
  • >= 3.32.0, < 3.33.16Affected
  • >= 4.0.0, < 4.0.5Affected
org.mapfish.print.print-libmapfish
  • >= 3.0.0, < 3.28.30Affected
  • >= 3.29.0, < 3.30.32Affected
  • >= 3.31.0, < 3.31.24Affected
  • >= 3.32.0, < 3.33.16Affected
  • >= 4.0.0, < 4.0.5Affected
org.mapfish.print.print-servletmapfish
  • >= 3.0.0, < 3.28.30Affected
  • >= 3.29.0, < 3.30.32Affected
  • >= 3.31.0, < 3.31.24Affected
  • >= 3.32.0, < 3.33.16Affected
  • >= 4.0.0, < 4.0.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.