01 Record

CVE-2026-55848

mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

HighPUBLISHEDCNA: GitHub_M

CNA base score8.6 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

View raw JSON

02 Description

mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-28 22:31Z5 HR AGO

Last updated

2026-08-28 22:31Z5 HR AGO

Reserved

2026-06-17

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

High (CVSS 8.6)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weaknesses

CWE-611Improper Restriction of XML External Entity ReferenceBase

Data version

5.2

Document digest

95033004937915cca4428dd546a989082c1a99056ea864771951793b7db67afd

05 Affected products

VendorProductVersionsPlatforms

mapfishmapfish-print>= 3.0.0, < 3.28.30, >= 3.29.0, < 3.30.32, >= 3.31.0, < 3.31.24, >= 3.32.0, < 3.33.16, >= 4.0.0, < 4.0.5—

mapfishorg.mapfish.print.print-lib>= 3.0.0, < 3.28.30, >= 3.29.0, < 3.30.32, >= 3.31.0, < 3.31.24, >= 3.32.0, < 3.33.16, >= 4.0.0, < 4.0.5—

mapfishorg.mapfish.print.print-servlet>= 3.0.0, < 3.28.30, >= 3.29.0, < 3.30.32, >= 3.31.0, < 3.31.24, >= 3.32.0, < 3.33.16, >= 4.0.0, < 4.0.5—

06 References

github.comhttps://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68rx_refsource_CONFIRM
github.comhttps://github.com/mapfish/mapfish-print/pull/4212x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/pull/4215x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/pull/4216x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/pull/4217x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/pull/4219x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/pull/4221x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbecx_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcbx_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7dx_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/releases/tag/3.28.30x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/releases/tag/3.30.32x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/releases/tag/3.31.24x_refsource_MISC
github.comhttps://github.com/mapfish/mapfish-print/releases/tag/4.0.5x_refsource_MISC

CVE-2026-55848

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Description

03 Metadata

04 Affected products

05 References

CVE-2026-55848

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References