CVE-2026-55848mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types
- 8.6HighCVSS base score
- 0.53%Exploitation in 30 daysEPSS · top 55% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- YesPublic exploitsa reference or SSVC says so
Description
mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.
Show the exploits1
References tagged exploit1 reference
- https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r (opens in a new tab)x_refsource_CONFIRMexploit
Timeline
ID reserved
By GitHub_M
- 2 months later
· 2 months later
Published
- 3 days later
· 3 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVDNVD · Deferred | 3.1 | High8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.
Affected products
- affected >= 3.0.0, < 3.28.30
- affected >= 3.29.0, < 3.30.32
- affected >= 3.31.0, < 3.31.24
- affected >= 3.32.0, < 3.33.16
- affected >= 4.0.0, < 4.0.5
mapfish · org.mapfish.print.print-lib
- affected >= 3.0.0, < 3.28.30
- affected >= 3.29.0, < 3.30.32
- affected >= 3.31.0, < 3.31.24
- affected >= 3.32.0, < 3.33.16
- affected >= 4.0.0, < 4.0.5
mapfish · org.mapfish.print.print-servlet
- affected >= 3.0.0, < 3.28.30
- affected >= 3.29.0, < 3.30.32
- affected >= 3.31.0, < 3.31.24
- affected >= 3.32.0, < 3.33.16
- affected >= 4.0.0, < 4.0.5
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.mapfish.print:print-libGHSA-5v29-34h8-v68r (opens in a new tab)
- Mavenorg.mapfish.print:print-servletGHSA-5v29-34h8-v68r (opens in a new tab)
- Mavenorg.mapfish:print.print-servletGHSA-5v29-34h8-v68r (opens in a new tab)
References
References17
- https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/mapfish/mapfish-print/pull/4212 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/pull/4215 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/pull/4216 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/pull/4217 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/pull/4219 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/pull/4221 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/releases/tag/3.28.30 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/releases/tag/3.30.32 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/releases/tag/3.31.24 (opens in a new tab)x_refsource_MISC
- https://github.com/mapfish/mapfish-print/releases/tag/4.0.5 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-68018 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-5v29-34h8-v68r (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-55848)Record last updated .