{"answers":{"affected":"18 open source packages ship an affected version, including org.mapfish.print:print-lib, org.mapfish.print:print-servlet and org.mapfish:print.print-servlet.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55848 exists.","fix":"Upgrade org.mapfish.print:print-lib to a fixed version for your release line: 3.28.30, 3.30.32, 3.33.16 or 4.0.5.","what":"CVE-2026-55848 is a high-severity vulnerability in mapfish-print, published on 28 Aug 2026."},"fix_prompt":"Check this codebase for CVE-2026-55848 and fix it if it is affected.\n\nWhat it is: CVE-2026-55848 is a high-severity vulnerability in mapfish-print, published on 28 Aug 2026. \nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55848 exists.\n\nAffected packages and fixed versions:\n- org.mapfish.print:print-lib (Maven): affected from 3.0.0; fixed in 3.28.30\n- org.mapfish.print:print-lib (Maven): affected from 3.0.0; fixed in 3.28.30\n- org.mapfish.print:print-lib (Maven): affected from 3.29.0; fixed in 3.30.32\n- org.mapfish.print:print-lib (Maven): affected from 3.29.0; fixed in 3.30.32\n- org.mapfish.print:print-lib (Maven): affected from 3.32.0; fixed in 3.33.16\n- org.mapfish.print:print-lib (Maven): affected from 3.32.0; fixed in 3.33.16\n- org.mapfish.print:print-lib (Maven): affected from 3.34.0; fixed in 4.0.5\n- org.mapfish.print:print-lib (Maven): affected from 3.34.0; fixed in 4.0.5\n- org.mapfish.print:print-servlet (Maven): affected from 3.29.0; fixed in 3.30.32\n- org.mapfish.print:print-servlet (Maven): affected from 3.29.0; fixed in 3.30.32\n- org.mapfish.print:print-servlet (Maven): affected from 3.31.0; fixed in 3.31.24\n- org.mapfish.print:print-servlet (Maven): affected from 3.31.0; fixed in 3.31.24\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-55848/ (Markdown: https://insights.sbomify.com/CVE-2026-55848/index.md)","id":"CVE-2026-55848","markdown":"https://insights.sbomify.com/CVE-2026-55848/index.md","name":"CVE-2026-55848","record":{"aliases":["GHSA-5v29-34h8-v68r"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"description":"mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types","id":"CVE-2026-55848","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":null,"year":"2026"},"n_packages":18,"n_references":17,"next":{"headline":"@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument","id":"CVE-2026-55849"},"packages":[{"ecosystem":"Maven","fixed":["3.28.30"],"introduced":["3.0.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.28.30"],"introduced":["3.0.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":"pkg:maven/org.mapfish.print/print-lib","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.30.32"],"introduced":["3.29.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.30.32"],"introduced":["3.29.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":"pkg:maven/org.mapfish.print/print-lib","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.33.16"],"introduced":["3.32.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.33.16"],"introduced":["3.32.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":"pkg:maven/org.mapfish.print/print-lib","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["4.0.5"],"introduced":["3.34.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["4.0.5"],"introduced":["3.34.0"],"last_affected":[],"package":"org.mapfish.print:print-lib","purl":"pkg:maven/org.mapfish.print/print-lib","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.30.32"],"introduced":["3.29.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.30.32"],"introduced":["3.29.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":"pkg:maven/org.mapfish.print/print-servlet","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.31.24"],"introduced":["3.31.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.31.24"],"introduced":["3.31.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":"pkg:maven/org.mapfish.print/print-servlet","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.33.16"],"introduced":["3.32.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.33.16"],"introduced":["3.32.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":"pkg:maven/org.mapfish.print/print-servlet","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["4.0.5"],"introduced":["3.34.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["4.0.5"],"introduced":["3.34.0"],"last_affected":[],"package":"org.mapfish.print:print-servlet","purl":"pkg:maven/org.mapfish.print/print-servlet","source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.28.30"],"introduced":["3.0.0"],"last_affected":[],"package":"org.mapfish:print.print-servlet","purl":null,"source":"GHSA-5v29-34h8-v68r"},{"ecosystem":"Maven","fixed":["3.28.30"],"introduced":["3.0.0"],"last_affected":[],"package":"org.mapfish:print.print-servlet","purl":"pkg:maven/org.mapfish/print.print-servlet","source":"GHSA-5v29-34h8-v68r"}],"prev":{"headline":"Allure: Stored XSS via unescaped ANSI helper in Allure report status message/trace rendering","id":"CVE-2026-55847"},"products":["mapfish-print","org.mapfish.print.print-lib","org.mapfish.print.print-servlet"],"published":"2026-08-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-31","vendors":["mapfish"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-55848/"}