« Volver al listado

CVE-2026-55848

Estado: AplazadaAlta (8.6)—

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path.

Leer descripción completaMostrar menos

This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XXE en endpoint /api/print3/print sin autenticación (AV:N/PR:N/UI:N) permite lectura de archivos locales y SSRF. CWE-611 confirma la vulnerabilidad de entidades externas XML.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mapfish — PrintAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-55848",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55848",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-31T14:07:17.404690Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mapfish",
          "product": "mapfish-print",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.28.30"
            },
            {
              "status": "affected",
              "version": ">= 3.29.0, < 3.30.32"
            },
            {
              "status": "affected",
              "version": ">= 3.31.0, < 3.31.24"
            },
            {
              "status": "affected",
              "version": ">= 3.32.0, < 3.33.16"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.0.5"
            }
          ]
        },
        {
          "vendor": "mapfish",
          "product": "org.mapfish.print.print-lib",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.28.30"
            },
            {
              "status": "affected",
              "version": ">= 3.29.0, < 3.30.32"
            },
            {
              "status": "affected",
              "version": ">= 3.31.0, < 3.31.24"
            },
            {
              "status": "affected",
              "version": ">= 3.32.0, < 3.33.16"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.0.5"
            }
          ]
        },
        {
          "vendor": "mapfish",
          "product": "org.mapfish.print.print-servlet",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0, < 3.28.30"
            },
            {
              "status": "affected",
              "version": ">= 3.29.0, < 3.30.32"
            },
            {
              "status": "affected",
              "version": ">= 3.31.0, < 3.31.24"
            },
            {
              "status": "affected",
              "version": ">= 3.32.0, < 3.33.16"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 4.0.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-28T23:17:08.013",
  "references": [
    {
      "url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/pull/4212",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/pull/4215",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/pull/4216",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/pull/4217",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/pull/4219",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/pull/4221",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
    }
  ],
  "lastModified": "2026-09-09T21:09:13.080",
  "sourceIdentifier": "security-advisories@github.com"
}