VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/55xxx/CVE-2026-55848.json
T

306 lines
13 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-55848",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"state": "PUBLISHED",
"assignerShortName": "GitHub_M",
"dateReserved": "2026-06-17T16:44:40.994Z",
"datePublished": "2026-08-28T22:31:26.705Z",
"dateUpdated": "2026-08-31T14:10:14.891Z"
},
"containers": {
"cna": {
"title": "mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types",
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"lang": "en",
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"type": "CWE"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"references": [
{
"name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"
},
{
"name": "https://github.com/mapfish/mapfish-print/pull/4212",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/pull/4212"
},
{
"name": "https://github.com/mapfish/mapfish-print/pull/4215",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/pull/4215"
},
{
"name": "https://github.com/mapfish/mapfish-print/pull/4216",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/pull/4216"
},
{
"name": "https://github.com/mapfish/mapfish-print/pull/4217",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/pull/4217"
},
{
"name": "https://github.com/mapfish/mapfish-print/pull/4219",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/pull/4219"
},
{
"name": "https://github.com/mapfish/mapfish-print/pull/4221",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/pull/4221"
},
{
"name": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"
},
{
"name": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"
},
{
"name": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"
},
{
"name": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"
},
{
"name": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"
},
{
"name": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"
},
{
"name": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"
},
{
"name": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"
},
{
"name": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"
},
{
"name": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"
}
],
"affected": [
{
"vendor": "mapfish",
"product": "mapfish-print",
"versions": [
{
"version": ">= 3.0.0, < 3.28.30",
"status": "affected"
},
{
"version": ">= 3.29.0, < 3.30.32",
"status": "affected"
},
{
"version": ">= 3.31.0, < 3.31.24",
"status": "affected"
},
{
"version": ">= 3.32.0, < 3.33.16",
"status": "affected"
},
{
"version": ">= 4.0.0, < 4.0.5",
"status": "affected"
}
]
},
{
"vendor": "mapfish",
"product": "org.mapfish.print.print-lib",
"versions": [
{
"version": ">= 3.0.0, < 3.28.30",
"status": "affected"
},
{
"version": ">= 3.29.0, < 3.30.32",
"status": "affected"
},
{
"version": ">= 3.31.0, < 3.31.24",
"status": "affected"
},
{
"version": ">= 3.32.0, < 3.33.16",
"status": "affected"
},
{
"version": ">= 4.0.0, < 4.0.5",
"status": "affected"
}
]
},
{
"vendor": "mapfish",
"product": "org.mapfish.print.print-servlet",
"versions": [
{
"version": ">= 3.0.0, < 3.28.30",
"status": "affected"
},
{
"version": ">= 3.29.0, < 3.30.32",
"status": "affected"
},
{
"version": ">= 3.31.0, < 3.31.24",
"status": "affected"
},
{
"version": ">= 3.32.0, < 3.33.16",
"status": "affected"
},
{
"version": ">= 4.0.0, < 4.0.5",
"status": "affected"
}
]
}
],
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-08-28T22:31:26.705Z"
},
"descriptions": [
{
"lang": "en",
"value": "mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5."
}
],
"source": {
"advisory": "GHSA-5v29-34h8-v68r",
"discovery": "UNKNOWN"
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-08-31T14:07:17.404690Z",
"id": "CVE-2026-55848",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-08-31T14:10:14.891Z"
}
}
]
}
}
View Git Blame Copy Permalink