CVE-2026-55848

Received Received - Intake

XML External Entity Injection in MapFish Print

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55848

Affected Vendors & Products

Vendor	Product	Version / Range
mapfish	mapfish_print	to 3.28.30 (exc)
mapfish	mapfish_print	3.28.30
mapfish	mapfish_print	3.30.32
mapfish	mapfish_print	3.31.24
mapfish	mapfish_print	3.33.16
mapfish	mapfish_print	4.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability in mapfish-print allows unauthenticated attackers to read sensitive files on the server by exploiting improper XML parsing. The issue occurs when the application processes attacker-controlled GML layer URLs without disabling external entities in XML parsing. This enables file disclosure and potential server-side request forgery.

Detection Guidance

To detect this vulnerability, check if your MapFish Print instance is running a vulnerable version (prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5). Inspect network traffic for requests to /api/print3/print with attacker-controlled GML layer URLs. Monitor for unusual file access patterns or SSRF attempts.

Impact Analysis

An attacker could exploit this to access sensitive files like operating system accounts, Kubernetes tokens, or certificates. This could lead to unauthorized data exposure, privilege escalation, or further network compromise depending on the exposed information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade mapfish-print to a fixed version: 3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5 or later. If upgrading is not immediately possible, disable the /api/print3/print endpoint or restrict access to trusted sources only.

Hi! I’m here to help you understand CVE-2026-55848. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70