Description

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-28T23:17:08.013Z",
  "pubdate": "2026-08-28T23:17:08.013Z",
  "executiveSummary": "MapFish Print contains a critical XML External Entity (XXE) injection vulnerability within its GML layer processing functionality.\nThe flaw allows unauthenticated remote attackers to perform arbitrary local file disclosure and server-side request forgery (SSRF).\nBy supplying a malicious XML document containing crafted DTDs to the /api/print3/print endpoint, an attacker can coerce the server into reading sensitive local files—such as Kubernetes service-account tokens or system credentials—and returning their contents via error messages.\nAdditionally, the vulnerability permits the server to initiate unauthorized network requests to internal resources, posing a severe risk to internal infrastructure security.\nThis vulnerability affects versions prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.\nThe risk is considered high due to the lack of authentication requirements and the potential for full sensitive data exposure and internal network reconnaissance.",
  "technicalDetails": "The root cause of this vulnerability is the insecure configuration of the XML parser used within core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java. When processing GML layer data, the application fails to explicitly disable the processing of external entities and external Document Type Definitions (DTDs).\nAn unauthenticated attacker can exploit this by sending a crafted print request to the /api/print3/print endpoint. The request includes a user-controlled URL pointing to an attacker-hosted XML document. The Java-based XML parser, when processing the GML layer, resolves the external entities defined within the remote DTD. By defining a parameter entity that maps to a local file system path (e.g., /etc/passwd or /var/run/secrets/kubernetes.io/serviceaccount/token), the parser includes the contents of these files in the XML document structure.\nThe vulnerability is compounded by the application's error handling mechanism. If the GML parsing process encounters an issue, the resultant error message may reflect the contents of the expanded entities back to the requester. This provides the attacker with a side-channel to exfiltrate sensitive local files.\nFurthermore, the XXE capability can be pivoted to facilitate Server-Side Request Forgery (SSRF). By substituting the file entity target with an internal URI, the attacker forces the MapFish Print server to perform HTTP requests on their behalf. This bypasses network perimeters, allowing the attacker to interact with internal services that are not exposed to the public internet.\nAffected versions include all releases prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5. The vulnerability does not require authentication, making it reachable by any remote actor capable of communicating with the endpoint. Post-exploitation, an attacker can gain system-level knowledge, steal secrets (e.g., cloud provider metadata or Kubernetes tokens), and leverage the server as a proxy for further exploitation of the internal network architecture."
}