Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-55848 (GCVE-0-2026-55848)

Vulnerability from nvd – Published: 2026-08-28 22:31 – Updated: 2026-08-28 22:31

Title

mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

Summary

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

GitHub_M mitre root

References

17 references

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM
https://github.com/mapfish/mapfish-print/pull/4212	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4215	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4216	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4217	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4219	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4221	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/1…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/2…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/3…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/5…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/a…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/d…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
mapfish	mapfish-print	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5
mapfish	org.mapfish.print.print-lib	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5
mapfish	org.mapfish.print.print-servlet	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-lib",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-servlet",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T22:31:26.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4212",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4212"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4215",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4215"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4216",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4216"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4217",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4217"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4219",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4219"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4221",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4221"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-5v29-34h8-v68r",
        "discovery": "UNKNOWN"
      },
      "title": "mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55848",
    "datePublished": "2026-08-28T22:31:26.705Z",
    "dateReserved": "2026-06-17T16:44:40.994Z",
    "dateUpdated": "2026-08-28T22:31:26.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44672 (GCVE-0-2026-44672)

Vulnerability from nvd – Published: 2026-05-28 14:35 – Updated: 2026-05-28 15:26

Title

mapfish-print: Remote Code Injection (RCE) in Dynamic table

Summary

mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 15:25 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM

Impacted products

4 products

Vendor	Product	Version
mapfish	mapfish-print	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3
camptocamp	mapfish_print	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3
org.mapfish	print.print-lib	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3
org.mapfish	print.print-servlet	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:25:47.863126Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T15:26:01.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        },
        {
          "product": "mapfish_print",
          "vendor": "camptocamp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        },
        {
          "product": "print.print-lib",
          "vendor": "org.mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        },
        {
          "product": "print.print-servlet",
          "vendor": "org.mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code  in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T14:35:29.378Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx"
        }
      ],
      "source": {
        "advisory": "GHSA-q7m6-wpvf-mvwx",
        "discovery": "UNKNOWN"
      },
      "title": "mapfish-print: Remote Code Injection (RCE) in Dynamic table"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44672",
    "datePublished": "2026-05-28T14:35:29.378Z",
    "dateReserved": "2026-05-07T16:20:08.659Z",
    "dateUpdated": "2026-05-28T15:26:01.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-15232 (GCVE-0-2020-15232)

Vulnerability from nvd – Published: 2020-10-02 19:45 – Updated: 2024-08-04 13:08

Title

XML External Entity attack in mapfish-print

Summary

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM
https://github.com/mapfish/mapfish-print/pull/139…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mapfish	mapfish-print	Affected: < 3.24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.897Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-02T19:45:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e"
        }
      ],
      "source": {
        "advisory": "GHSA-vjv6-gq77-3mjw",
        "discovery": "UNKNOWN"
      },
      "title": "XML External Entity attack in mapfish-print",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15232",
          "STATE": "PUBLIC",
          "TITLE": "XML External Entity attack in mapfish-print"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "mapfish-print",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "mapfish"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-611: Improper Restriction of XML External Entity Reference"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw",
              "refsource": "CONFIRM",
              "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e",
              "refsource": "MISC",
              "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-vjv6-gq77-3mjw",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15232",
    "datePublished": "2020-10-02T19:45:15.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-15231 (GCVE-0-2020-15231)

Vulnerability from nvd – Published: 2020-10-02 19:40 – Updated: 2024-08-04 13:08

Title

Cross-site scripting attack in mapfish-print

Summary

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM
https://github.com/mapfish/mapfish-print/pull/139…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mapfish	mapfish-print	Affected: < 3.24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:23.265Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-02T19:40:14.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e"
        }
      ],
      "source": {
        "advisory": "GHSA-w534-q4xf-h5v2",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-site scripting attack in mapfish-print",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15231",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site scripting attack in mapfish-print"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "mapfish-print",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "mapfish"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2",
              "refsource": "CONFIRM",
              "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e",
              "refsource": "MISC",
              "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-w534-q4xf-h5v2",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15231",
    "datePublished": "2020-10-02T19:40:14.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:23.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-55848 (GCVE-0-2026-55848)

Vulnerability from cvelistv5 – Published: 2026-08-28 22:31 – Updated: 2026-08-28 22:31

Title

mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

Summary

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

GitHub_M mitre root

References

17 references

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM
https://github.com/mapfish/mapfish-print/pull/4212	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4215	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4216	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4217	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4219	x_refsource_MISC
https://github.com/mapfish/mapfish-print/pull/4221	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/1…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/2…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/3…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/5…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/a…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/commit/d…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC
https://github.com/mapfish/mapfish-print/releases…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
mapfish	mapfish-print	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5
mapfish	org.mapfish.print.print-lib	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5
mapfish	org.mapfish.print.print-servlet	Affected: >= 3.0.0, < 3.28.30 Affected: >= 3.29.0, < 3.30.32 Affected: >= 3.31.0, < 3.31.24 Affected: >= 3.32.0, < 3.33.16 Affected: >= 4.0.0, < 4.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-lib",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        },
        {
          "product": "org.mapfish.print.print-servlet",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.28.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.32"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.24"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T22:31:26.705Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4212",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4212"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4215",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4215"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4216",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4216"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4217",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4217"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4219",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4219"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/pull/4221",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/4221"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
        },
        {
          "name": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-5v29-34h8-v68r",
        "discovery": "UNKNOWN"
      },
      "title": "mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55848",
    "datePublished": "2026-08-28T22:31:26.705Z",
    "dateReserved": "2026-06-17T16:44:40.994Z",
    "dateUpdated": "2026-08-28T22:31:26.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44672 (GCVE-0-2026-44672)

Vulnerability from cvelistv5 – Published: 2026-05-28 14:35 – Updated: 2026-05-28 15:26

Title

mapfish-print: Remote Code Injection (RCE) in Dynamic table

Summary

mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 15:25 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM

Impacted products

4 products

Vendor	Product	Version
mapfish	mapfish-print	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3
camptocamp	mapfish_print	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3
org.mapfish	print.print-lib	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3
org.mapfish	print.print-servlet	Affected: >= 3.23.0, < 3.28.28 Affected: >= 3.29.0, < 3.30.30 Affected: >= 3.31.0, < 3.31.21 Affected: >= 3.32.0, < 3.33.14 Affected: >= 3.34.0, < 4.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:25:47.863126Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T15:26:01.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        },
        {
          "product": "mapfish_print",
          "vendor": "camptocamp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        },
        {
          "product": "print.print-lib",
          "vendor": "org.mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        },
        {
          "product": "print.print-servlet",
          "vendor": "org.mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.23.0, \u003c 3.28.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.29.0, \u003c 3.30.30"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.31.0, \u003c 3.31.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.32.0, \u003c 3.33.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.34.0, \u003c 4.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code  in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T14:35:29.378Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx"
        }
      ],
      "source": {
        "advisory": "GHSA-q7m6-wpvf-mvwx",
        "discovery": "UNKNOWN"
      },
      "title": "mapfish-print: Remote Code Injection (RCE) in Dynamic table"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44672",
    "datePublished": "2026-05-28T14:35:29.378Z",
    "dateReserved": "2026-05-07T16:20:08.659Z",
    "dateUpdated": "2026-05-28T15:26:01.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2020-15232 (GCVE-0-2020-15232)

Vulnerability from cvelistv5 – Published: 2020-10-02 19:45 – Updated: 2024-08-04 13:08

Title

XML External Entity attack in mapfish-print

Summary

In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM
https://github.com/mapfish/mapfish-print/pull/139…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mapfish	mapfish-print	Affected: < 3.24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.897Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611: Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-02T19:45:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e"
        }
      ],
      "source": {
        "advisory": "GHSA-vjv6-gq77-3mjw",
        "discovery": "UNKNOWN"
      },
      "title": "XML External Entity attack in mapfish-print",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15232",
          "STATE": "PUBLIC",
          "TITLE": "XML External Entity attack in mapfish-print"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "mapfish-print",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "mapfish"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-611: Improper Restriction of XML External Entity Reference"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw",
              "refsource": "CONFIRM",
              "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-vjv6-gq77-3mjw"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e",
              "refsource": "MISC",
              "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-vjv6-gq77-3mjw",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15232",
    "datePublished": "2020-10-02T19:45:15.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-15231 (GCVE-0-2020-15231)

Vulnerability from cvelistv5 – Published: 2020-10-02 19:40 – Updated: 2024-08-04 13:08

Title

Cross-site scripting attack in mapfish-print

Summary

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/mapfish/mapfish-print/security…	x_refsource_CONFIRM
https://github.com/mapfish/mapfish-print/pull/139…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
mapfish	mapfish-print	Affected: < 3.24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:23.265Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mapfish-print",
          "vendor": "mapfish",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.24"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-02T19:40:14.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e"
        }
      ],
      "source": {
        "advisory": "GHSA-w534-q4xf-h5v2",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-site scripting attack in mapfish-print",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15231",
          "STATE": "PUBLIC",
          "TITLE": "Cross-site scripting attack in mapfish-print"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "mapfish-print",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.24"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "mapfish"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2",
              "refsource": "CONFIRM",
              "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-w534-q4xf-h5v2"
            },
            {
              "name": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e",
              "refsource": "MISC",
              "url": "https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-w534-q4xf-h5v2",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15231",
    "datePublished": "2020-10-02T19:40:14.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:23.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

8 vulnerabilities by mapfish

CVE-2026-55848 (GCVE-0-2026-55848)

CVE-2026-44672 (GCVE-0-2026-44672)

CVE-2020-15232 (GCVE-0-2020-15232)

CVE-2020-15231 (GCVE-0-2020-15231)

CVE-2026-55848 (GCVE-0-2026-55848)

CVE-2026-44672 (GCVE-0-2026-44672)

CVE-2020-15232 (GCVE-0-2020-15232)

CVE-2020-15231 (GCVE-0-2020-15231)