XXE Vulnerability in MapFish Print

MapFish Print, a Java-based web application for generating printable reports, contains an XML External Entity (XXE) vulnerability identified as CVE-2026-55848. The issue originates from the way the print service processes GML layers. By submitting a JSON payload to the /api/print3/print/mapviewer/buildreport.pdf endpoint with a manipulated GML layer URL, an attacker can point the application to a remote, malicious DTD file.

When processed, this configuration triggers the XXE, which can be leveraged to exfiltrate local files from the server, perform directory listing, or initiate SSRF attacks against internal network resources. The vulnerability affects multiple versions of the print-lib and print-servlet components within the 3.x and 4.x branches. This impact is significant for organizations deploying MapFish Print in cloud environments, as it may lead to the exposure of Kubernetes service account tokens or other sensitive system credentials.

Attack Chain

1. The attacker stands up a remote server hosting a malicious PHP script (xxe.php) and an associated DTD file (evil.dtd).
2. The attacker constructs a JSON request for the MapFish Print buildreport.pdf endpoint.
3. The JSON request includes a layers object with the type set to gml and a url pointing to the attacker-controlled xxe.php script with a file path parameter (e.g., /etc/passwd).
4. The MapFish Print server initiates an HTTP request to the attacker-controlled xxe.php server to retrieve the XML configuration.
5. The attacker's server responds with an XML document containing the malicious DTD and the defined entity, which triggers the file read on the MapFish server.
6. The MapFish server attempts to load the file referenced by the entity, and the error processing mechanism (specifically 404 handler) returns the content of the target file in the response body.
7. The attacker receives the sensitive file contents directly in the HTTP response from the MapFish Print service.

Impact

Successful exploitation allows for the unauthorized disclosure of local server files, including sensitive configuration files and credentials. Furthermore, the vulnerability supports SSRF, enabling attackers to interact with internal infrastructure, potentially bypassing network segmentation or accessing metadata services in cloud environments.

Recommendation

1. Upgrade MapFish Print to the latest version (v4.0.5 or higher) to remediate CVE-2026-55848.
2. Implement an egress filtering policy on all MapFish Print servers to restrict outbound HTTP/HTTPS connections, preventing the application from fetching untrusted remote DTDs.
3. Deploy WAF rules to inspect JSON payloads sent to the print API for anomalous GML layer URLs, specifically looking for external domains or unusual URI parameters.
4. Review server logs for anomalous outbound HTTP requests originating from the MapFish Print application process.