CVE-2026-55848: CWE-611: Improper Restriction of XML External Entity Reference in mapfish mapfish-print

Mapfish-print versions prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5 are vulnerable to an XML External Entity (XXE) injection vulnerability (CWE-611) in the GmlLayer.java component. The vulnerability arises because the software parses XML from attacker-controlled GML layer URLs without disabling external entities and external DTDs. This allows remote attackers to cause the XML parser to expand local file entities, exposing sensitive files such as operating system account data, Kubernetes service-account tokens, and certificates. Additionally, attackers can replace the file entity target with internal HTTP endpoints to perform server-side request forgery (SSRF). The vulnerability is exploitable without authentication and has a CVSS 3.1 base score of 8.6 (high severity). The issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

An unauthenticated remote attacker can exploit this vulnerability to read sensitive local files on the server running mapfish-print, including potentially critical credentials and tokens. The attacker can also perform server-side request forgery (SSRF) by redirecting XML entity references to internal HTTP endpoints. This can lead to information disclosure and potentially facilitate further attacks within the internal network. The vulnerability does not allow code execution or denial of service directly but poses a significant confidentiality risk.

This vulnerability is fixed in mapfish-print versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5. Users should upgrade to one of these versions or later to remediate the issue. Patch status is confirmed by the vendor's versioning information in the description. No other mitigation or temporary workaround is indicated in the available data.