CVE-2026-55848

MapFish Print versions prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5 contain an XML external entity (XXE) injection flaw (CWE-611) in the GML layer parsing path (GmlLayer.java). An unauthenticated attacker sends a request to the /api/print3/print endpoint with an attacker-controlled GML layer URL; the server fetches that XML and parses it with external entities and external DTDs enabled, allowing a remote document and DTD to expand a local file entity whose contents leak back through the GML parsing and error path. This lets attackers read local files such as OS account data, Kubernetes service-account tokens, and certificates, and by swapping the file entity target for an internal HTTP endpoint they can also perform server-side request forgery (SSRF) against internal networks. Any deployment of MapFish Print in the affected versions is exposed, with confidentiality impact rated high (CVSS 3.1: 8.6, Scope changed). No public proof-of-concept, no KEV listing, and a low 0.3% EPSS indicate no known exploitation at this time.

What to do: Upgrade MapFish Print to the fixed version on your branch: 3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5. As interim mitigation, restrict network access to the /api/print3/print endpoint, limit the print service's outbound egress to trusted hosts, and validate or whitelist GML layer URLs. Inventory exposed instances — especially Kubernetes-hosted deployments, where service-account tokens and certificates are readable — and prioritize patching any that are internet-facing.