CVE-2026-44672: Remote Code Injection Vulnerability in Mapfish Print Packages
Summary
CVE-2026-44672: Mapfish Print: Remote Code Injection (RCE) in Dynamic table. Affects org.mapfish.print:print-lib across 5 version ranges.
>= 3.23.0, < 3.28.28
>= 3.29.0, < 3.30.30
>= 3.31.0, < 3.31.21
>= 3.32.0, < 3.33.14
>= 3.34.0, < 4.0.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mapfish Print is an open-source library designed for generating print documents from various data sources. It is widely used in web applications to create customizable print layouts. The library supports dynamic tables, allowing users to generate complex documents with ease. However, a critical vulnerability has been identified that allows attackers to execute arbitrary code remotely, posing significant security risks.
Vulnerability Detail
The vulnerability arises from improper handling of user input in dynamic tables within the Mapfish Print library. An attacker can exploit this flaw to inject malicious code, which can be executed on the server without authentication. This could lead to unauthorized access, data breaches, and potential system compromise. The vulnerability has been classified under CWE-94 (Code Injection) and has a CVSS score of 9.3, indicating its critical nature.
How To Fix
Latest published version: 3.22.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.23.0, < 3.28.283.28.28 -
>= 3.29.0, < 3.30.303.30.30 -
>= 3.31.0, < 3.31.213.31.21 -
>= 3.32.0, < 3.33.143.33.14 -
>= 3.34.0, < 4.0.34.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization to mitigate the risk of code injection. Ensure that user inputs are properly escaped and validated before processing.
Conclusion
The CVE-2026-44672 vulnerability poses a significant risk to applications using the Mapfish Print library. Immediate action is required to upgrade to the patched versions to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for org.mapfish.print:print-lib →
FAQ
CVE-2026-44672 is a critical vulnerability in the Mapfish Print library that allows remote code execution through dynamic tables.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's pom.xml against the vulnerability using the Vulert playground.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete system compromise.
Update your Maven dependencies in your pom.xml file to the recommended patched versions provided in the 'how_to_fix' section.
Yes, implementing input validation and sanitization can help reduce the risk of code injection until an upgrade can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.mapfish.print:print-lib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
