Executive brief
MapFish Print is a web-based map printing service used to generate PDF reports from geographic data layers. An XML External Entity (XXE) vulnerability in the GML layer processing allows an unauthenticated remote attacker to read sensitive files from the server (such as Kubernetes secrets, certificates, or system files like /etc/passwd) and perform server-side request forgery (SSRF) attacks. An attacker can exploit this by hosting a malicious XML/DTD payload and referencing it through the Print API, causing the server to fetch and exfiltrate protected data in error responses.
Technical details
The vulnerability is an XML External Entity (XXE) injection in MapFish Print's GML (Geography Markup Language) layer processing. When processing a GML layer URL in the Print API (/api/print3/print/*/buildreport.pdf), the application parses untrusted XML without properly disabling external entity resolution. An attacker can host a remote PHP script (or similar) that returns malicious XML with DOCTYPE declarations defining external entities pointing to local files (file://) or internal services (https://). By chaining this with a DTD that exfiltrates the file content through error-based XXE techniques, the attacker can read arbitrary files accessible to the MapFish process, such as /etc/passwd, Kubernetes service account tokens, TLS certificates, and configuration files. The exfiltration occurs via 404 error messages that echo the file path, allowing blind exfiltration. No authentication or user interaction is required; the attack is triggered via a single HTTP POST request to the buildreport.pdf endpoint. Patches are available in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.
Affected products
- MapFish MapFish Print 3.0.0–3.28.29, 3.29.0–3.30.31, 3.32.0–3.33.15, 3.34.0–4.0.4
- MapFish print-lib (Maven) 3.0.0–3.28.29, 3.29.0–3.30.31, 3.32.0–3.33.15, 3.34.0–4.0.4
- MapFish print-servlet (Maven) 3.29.0–3.30.31, 3.31.0–3.31.23, 3.32.0–3.33.15, 3.34.0–4.0.4
Timeline
- 2026-08-28: disclosed: Publicly disclosed via GitHub Advisory GHSA-5v29-34h8-v68r
- 2026-06-22: patched: Patches released: 3.28.30, 3.30.32, 3.31.24, 3.33.16, 4.0.5