CVE-2026-55848: MapFish Print SSRF Vulnerability

CVE-2026-55848 Overview

CVE-2026-55848 is an XML External Entity (XXE) vulnerability in MapFish Print, a component of MapFish used for printing templated cartographic maps. The /api/print3/print endpoint accepts an attacker-controlled GML layer URL and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities or external DTDs. A remote XML document and DTD can expand a local file entity, exposing content through the GML parsing error path. The flaw is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.

Critical Impact
Unauthenticated attackers can read local files, including operating-system account data, Kubernetes service-account tokens, and TLS certificates. Replacing the file entity target with an internal HTTP endpoint permits Server-Side Request Forgery (SSRF).

Affected Products

MapFish Print versions prior to 3.28.30 (3.28.x branch)
MapFish Print versions prior to 3.30.32, 3.31.24, and 3.33.16 (3.30/3.31/3.33 branches)
MapFish Print versions prior to 4.0.5 (4.x branch)

Discovery Timeline

2026-08-28 - CVE-2026-55848 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55848

Vulnerability Analysis

The vulnerability is a classic XML External Entity injection [CWE-611] in the GML layer parser. When a print request references a remote GML resource, MapFish Print retrieves the XML and passes it to a DocumentBuilder that has not been hardened against external entity resolution. The parser follows SYSTEM identifiers to arbitrary URIs, including file:// and http:// schemes. Because the request path returns parsed content or verbose error messages, entity content is echoed back to the caller. The request requires no authentication, and the change in exploitation scope covers files and internal services reachable by the print worker.

Root Cause

The GmlLayer class instantiates an XML parser using default DocumentBuilderFactory settings. Default JAXP settings resolve external general entities and external DTDs, which is required to enable XXE. The parser is not configured with FEATURE_SECURE_PROCESSING, and features such as http://apache.org/xml/features/disallow-doctype-decl and external-general-entities are not disabled before parsing untrusted input.

Attack Vector

An unauthenticated remote attacker submits a print request to /api/print3/print with a GML layer url field pointing at an attacker-controlled server. That server returns an XML document with a DOCTYPE referencing an external DTD. The DTD defines a parameter entity that reads a local file (for example /etc/passwd or /var/run/secrets/kubernetes.io/serviceaccount/token) and exfiltrates the content via a second network request or via the GML parsing error path. Substituting an internal URL such as http://169.254.169.254/ in the entity target yields SSRF against cloud metadata services.

java

// Security patch: hardening GML parsing against XXE
package org.mapfish.print.map.geotools;

import java.io.ByteArrayInputStream;
import java.nio.charset.StandardCharsets;
import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilderFactory;
import org.eclipse.emf.ecore.resource.URIHandler;
import org.geotools.data.FeatureSource;
import org.geotools.data.collection.CollectionFeatureSource;

Source: Mapfish Print Commit 13beae7

The fix introduces javax.xml.XMLConstants and DocumentBuilderFactory so the parser can be configured with secure processing features that disable DOCTYPE declarations and external entity resolution before any untrusted XML is deserialized.

Detection Methods for CVE-2026-55848

Indicators of Compromise

Inbound POST requests to /api/print3/print containing GML layer definitions with external url values pointing to untrusted domains.
Outbound HTTP or DNS traffic from the MapFish Print host to unknown external hosts immediately following a print request.
Application logs from GmlLayer showing XML parsing errors that include file contents such as /etc/passwd fragments or Kubernetes token strings.
Requests from the print service to internal metadata endpoints such as 169.254.169.254 or to internal-only URLs not referenced elsewhere in the deployment.

Detection Strategies

Inspect print request bodies for <!DOCTYPE, <!ENTITY, SYSTEM, or PUBLIC tokens within GML payloads reaching the print API.
Alert when the MapFish Print process performs egress connections to hosts that are not part of the configured tile or WMS backend allowlist.
Correlate print API activity with reads of sensitive files by the Java process on the underlying host or container.

Monitoring Recommendations

Log full request bodies (or hashes and metadata) for /api/print3/print to enable retrospective XXE hunting.
Monitor Kubernetes audit logs for use of the print pod's service-account token from unexpected source IPs.
Track egress DNS queries from the print workload and alert on newly observed domains during or after a print job.

How to Mitigate CVE-2026-55848

Immediate Actions Required

Upgrade MapFish Print to 3.28.30, 3.30.32, 3.31.24, 3.33.16, or 4.0.5 depending on the deployed branch.
Rotate any secrets that were reachable by the print service, including Kubernetes service-account tokens, TLS private keys, and cloud credentials.
Restrict inbound access to /api/print3/print to trusted callers using authentication or a reverse-proxy allowlist.
Apply egress network policies so the print workload can only reach approved map data sources.

Patch Information

MapFish Print maintainers published fixes in release 3.28.30, release 3.30.32, release 3.31.24, and release 4.0.5. The fixes are also documented in security advisory GHSA-5v29-34h8-v68r and applied through pull requests #4212, #4215, #4216, #4217, #4219, and #4221.

Workarounds

Place a web application firewall in front of the print endpoint and block requests containing <!DOCTYPE or <!ENTITY in GML payloads.
Run the print service under a least-privilege service account with no access to Kubernetes secrets or cloud metadata endpoints.
Deploy the workload with egress restrictions that permit only allowlisted map data hosts.

bash

# Example Kubernetes NetworkPolicy restricting print pod egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: mapfish-print-egress
spec:
  podSelector:
    matchLabels:
      app: mapfish-print
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 10.20.30.0/24  # trusted WMS backend
    ports:
    - protocol: TCP
      port: 443