CVE-2026-55848: MapFish Print XXE Vulnerability Allows Arbitrary File Reading
Summary
CVE-2026-55848: MapFish Print has XXE that allows reading arbitrary files of certain types. Affects org.mapfish.print:print-lib across 4 version ranges.
>= 3.0.0, < 3.28.30
>= 3.29.0, < 3.30.32
>= 3.32.0, < 3.33.16
>= 3.34.0, < 4.0.5
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MapFish Print is an open-source library designed for generating print outputs from geographic data. It provides functionalities for handling various map formats and integrating them into printable documents. However, it is susceptible to XML External Entity (XXE) attacks, which can lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from the ability to host a remote script and DTD file, allowing an attacker to exploit the Print feature by sending a malicious URL as the GML layer. When a 404 error occurs, the server reveals the contents of the requested file, potentially exposing sensitive information such as system files or Kubernetes secrets. This XXE vulnerability can also facilitate Server-Side Request Forgery (SSRF) attacks, enabling attackers to access internal URLs.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.28.303.28.30 -
>= 3.29.0, < 3.30.323.30.32 -
>= 3.32.0, < 3.33.163.33.16 -
>= 3.34.0, < 4.0.54.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid using the GML layer feature or restrict access to the MapFish Print server to trusted sources only. Additionally, ensure that the server's XML parser is configured to disable external entity processing.
Conclusion
The XXE vulnerability in MapFish Print poses significant risks by allowing unauthorized file access and potential SSRF attacks. It is essential to update to the latest patched versions of the affected packages and implement recommended workarounds to mitigate these risks.
See every vulnerability recorded for org.mapfish.print:print-lib →
FAQ
XXE (XML External Entity) vulnerability allows an attacker to interfere with the processing of XML data, potentially leading to the disclosure of sensitive files or server-side request forgery.
You can use Vulert, which monitors open-source vulnerabilities in your software using just the pom.xml file. Visit the Vulert playground to check if your application is affected.
The risks include unauthorized access to sensitive files, potential exposure of internal services, and the ability to perform SSRF attacks.
Yes, the vulnerability has been patched in versions 3.28.30 and later for the affected packages. It is crucial to update to these versions.
If immediate updates are not possible, implement workarounds such as disabling external entity processing in the XML parser and restricting server access.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.mapfish.print:print-lib.
