{"uuid": "b2f35b2f-88c1-4097-85e8-ff9169a6b23e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55848", "type": "seen", "source": "https://gist.github.com/alon710/fd6e1d0021286f338be43882b18358f9", "content": "# CVE-2026-55848: CVE-2026-55848: GML Layer XML External Entity (XXE) Injection in MapFish Print\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55848\n\n## Summary\nAn XML External Entity (XXE) vulnerability in MapFish Print allows unauthenticated remote attackers to perform arbitrary local file disclosure and Server-Side Request Forgery (SSRF) by exploiting GML layer URL parameters in requests submitted to the /api/print3/print endpoint.\n\n## TL;DR\nUnauthenticated attackers can exploit the MapFish Print endpoint to read local server files and execute SSRF attacks by pointing the GML layer to a crafted remote XML document.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-611\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.6\n- **Impact**: Arbitrary File Disclosure, SSRF\n- **Exploit Status**: poc\n- **CISA KEV Status**: False\n\n## Affected Systems\n\n- MapFish Print Core Application Suite\n- org.mapfish.print:print-lib Maven package\n- org.mapfish.print:print-servlet Maven package\n- **mapfish-print**: >= 3.0.0, < 3.28.30 (Fixed in: `3.28.30`)\n- **mapfish-print**: >= 3.29.0, < 3.30.32 (Fixed in: `3.30.32`)\n- **mapfish-print**: >= 3.31.0, < 3.31.24 (Fixed in: `3.31.24`)\n- **mapfish-print**: >= 3.32.0, < 3.33.16 (Fixed in: `3.33.16`)\n- **mapfish-print**: >= 4.0.0, < 4.0.5 (Fixed in: `4.0.5`)\n\n## Mitigation\n\n- Upgrade MapFish Print to patched versions (3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5)\n- Restrict egress network access for the MapFish Print host to block outbound entity resolution\n- Disable the GML layer type if it is not required by current application layouts\n- Apply WAF rules to detect and drop print requests containing external URLs within GML layer definitions\n\n**Remediation Steps:**\n1. Identify all MapFish Print deployments and check the current running version in dependency manifests (such as pom.xml or build.gradle files)\n2. Update the mapfish-print dependencies or servlet container packages to the appropriate patched release stream\n3. Verify the configuration of GmlLayer within the deployed service to confirm that external parsing is disabled\n4. Implement network-level egress restrictions to prevent the application from making arbitrary outbound requests\n5. Perform a scan using the provided verification signatures to ensure the endpoint no longer resolves inline DTDs\n\n## References\n\n- [GitHub Security Advisory GHSA-5v29-34h8-v68r](https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r)\n- [CVE-2026-55848 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-55848)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55848) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T07:31:59.149362Z"}