CVE-2026-55848: GML Layer XML External Entity (XXE) Injection in MapFish Print
Vulnerability ID: CVE-2026-55848
CVSS Score: 8.6
Published: 2026-08-28
An XML External Entity (XXE) vulnerability in MapFish Print allows unauthenticated remote attackers to perform arbitrary local file disclosure and Server-Side Request Forgery (SSRF) by exploiting GML layer URL parameters in requests submitted to the /api/print3/print endpoint.
TL;DR
Unauthenticated attackers can exploit the MapFish Print endpoint to read local server files and execute SSRF attacks by pointing the GML layer to a crafted remote XML document.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-611
- Attack Vector: Network
- CVSS v3.1: 8.6
- Impact: Arbitrary File Disclosure, SSRF
- Exploit Status: poc
- CISA KEV Status: False
Affected Systems
- MapFish Print Core Application Suite
- org.mapfish.print:print-lib Maven package
- org.mapfish.print:print-servlet Maven package
-
mapfish-print: >= 3.0.0, < 3.28.30 (Fixed in:
3.28.30) -
mapfish-print: >= 3.29.0, < 3.30.32 (Fixed in:
3.30.32) -
mapfish-print: >= 3.31.0, < 3.31.24 (Fixed in:
3.31.24) -
mapfish-print: >= 3.32.0, < 3.33.16 (Fixed in:
3.33.16) -
mapfish-print: >= 4.0.0, < 4.0.5 (Fixed in:
4.0.5)
Code Analysis
Commit: 13beae7
Fix: GML Layer XXE vulnerable parser configuration
Commit: 23a96e7
Fix: Add XXE restrictions on GML parser
Commit: 3525e81
Securing XML processing inside GeoTools GML integration layer
Commit: 56c47d3
Mitigate XXE vulnerability inside GML feature collection engine
Commit: a55a248
Refactor parser settings to block external DTD resolution
Commit: d13911a
Implement EntityResolver2 override for security controls in print service
Exploit Details
- GitHub Security Advisory: Details of the vulnerability and security implications on GML file reading capabilities.
Mitigation Strategies
- Upgrade MapFish Print to patched versions (3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5)
- Restrict egress network access for the MapFish Print host to block outbound entity resolution
- Disable the GML layer type if it is not required by current application layouts
- Apply WAF rules to detect and drop print requests containing external URLs within GML layer definitions
Remediation Steps:
- Identify all MapFish Print deployments and check the current running version in dependency manifests (such as pom.xml or build.gradle files)
- Update the mapfish-print dependencies or servlet container packages to the appropriate patched release stream
- Verify the configuration of GmlLayer within the deployed service to confirm that external parsing is disabled
- Implement network-level egress restrictions to prevent the application from making arbitrary outbound requests
- Perform a scan using the provided verification signatures to ensure the endpoint no longer resolves inline DTDs
References
Read the full report for CVE-2026-55848 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)