org.mapfish vulnerabilities

Products

• org.mapfish/print.print-servlet 2
• print.print-lib 1

Latest org.mapfish CVEs

Newest publication first

1. CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

   Published 2026-08-28

   High·CVSS 8.6

   mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/ma...

2. CVE-2026-44672 mapfish-print: Remote Code Injection (RCE) in Dynamic table

   Published 2026-05-28

   Critical·CVSS 9.3

   mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.3...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.