Which versions of Mapfish Print are affected by CVE-2026-44672?

Mapfish Print deployments are at critical risk from unauthenticated remote code execution (CVE-2026-44672, CVSS 9.3) in its Dynamic table feature that enables attackers to fully compromise the…. A patch is available.

How to fix or mitigate CVE-2026-44672?

Within 24 hours: Identify all Mapfish Print instances and assess network exposure; restrict access from untrusted networks if patching cannot be completed immediately. Within 7 days: Apply vendor-released patches per GHSA advisory to all instances across affected release lines. Within 30 days: Validate patch deployment via vulnerability scanning and conduct security testing of Dynamic table features.

Mapfish Print CVE-2026-44672

Q: What is the CVSS score of CVE-2026-44672?

CVE-2026-44672 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-32909 CRITICAL

Code Injection (CWE-94)

2026-05-13 https://github.com/mapfish/mapfish-print

GHSA-q7m6-wpvf-mvwx

Code Injection RCE

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 28, 2026 - 16:30 vuln.today

v3 (cvss_changed)

Analysis Updated

May 28, 2026 - 16:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 28, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 28, 2026 - 16:22 NVD

9.3 (CRITICAL)

Source Code Evidence Fetched

May 13, 2026 - 02:30 vuln.today

Analysis Generated

May 13, 2026 - 02:30 vuln.today

CVE Published

May 13, 2026 - 01:35 nvd

CRITICAL

DescriptionGitHub Advisory

Impact

The attacker can execute arbitrary code without being authenticated

Mitigation

Upgrade to a patched version (please check affected/patched version matrix)

Credits

Bug Bounty of Canton du Jura

AnalysisAI

Unauthenticated remote code execution in Mapfish Print (org.mapfish.print) allows attackers to execute arbitrary code via a code injection flaw in the Dynamic table feature. The vulnerability carries a CVSS 4.0 score of 9.3 with network-accessible, low-complexity exploitation requiring no privileges or user interaction. No public exploit identified at time of analysis, though the GHSA advisory and four parallel patched release lines indicate vendor-confirmed severity.

Technical ContextAI

Mapfish Print is a Java-based reporting/printing library and servlet (org.mapfish.print:print-lib and print-servlet, distributed via Maven) used to generate PDF/image reports from web map applications, commonly embedded in GeoServer and OpenLayers/MapFish stacks. The flaw is classified as CWE-94 (Improper Control of Generation of Code, i.e., Code Injection) and resides in the Dynamic table rendering feature, where attacker-controlled input is interpreted as executable code rather than treated as data - typical of expression-language or template injection paths in Java reporting components. The affected packages span four maintained branches (3.28.x, 3.30.x, 3.31.x, 3.33.x), indicating a long-lived defect in the dynamic table code path.

RemediationAI

Vendor-released patches are available; upgrade to 3.28.28, 3.30.30, 3.31.21, or 3.33.14 depending on the branch in use, per the GHSA advisory at https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx. If patching cannot be performed immediately, restrict network access to the Mapfish Print servlet endpoint (typically /print/*) so it is only reachable from trusted internal application backends rather than the public internet, and disable or remove configurations that expose the Dynamic table feature to user-controlled input - accepting the trade-off that downstream map applications relying on dynamic tables will lose that rendering capability until patched. Audit reverse proxy and WAF rules to block POST bodies containing unexpected expression-language or scripting tokens against the print endpoint as an interim filter, recognizing that template-injection payloads vary and filter bypasses are likely.