{"id":"CVE-2026-44672","aliases":["EUVD-2026-32909","GHSA-q7m6-wpvf-mvwx"],"status":"published","title":"mapfish-print: Remote Code Injection (RCE) in Dynamic table","description":"mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code  in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00325,"percentile":0.2591,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2026-05-13T01:35:37Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"Maven","package":"org.mapfish.print:print-lib","fixed_in":["3.28.28","3.30.30","3.31.21","3.33.14","4.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.mapfish.print:print-servlet","fixed_in":["3.28.28","3.30.30","3.31.21","3.33.14","4.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.0"},{"fixed":"3.28.28"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.29.0"},{"fixed":"3.30.30"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.0"},{"fixed":"3.31.21"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.32.0"},{"fixed":"3.33.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0"},{"fixed":"4.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.0"},{"fixed":"3.28.28"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.29.0"},{"fixed":"3.30.30"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.0"},{"fixed":"3.31.21"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.32.0"},{"fixed":"3.33.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0"},{"fixed":"4.0.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.0"},{"fixed":"3.28.28"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.29.0"},{"fixed":"3.30.30"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.0"},{"fixed":"3.31.21"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.32.0"},{"fixed":"3.33.14"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0"},{"fixed":"4.0.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.23.0"},{"fixed":"3.28.28"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.29.0"},{"fixed":"3.30.30"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.31.0"},{"fixed":"3.31.21"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.32.0"},{"fixed":"3.33.14"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.mapfish.print:print-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.34.0"},{"fixed":"4.0.3"}]}]}],"products":[{"vendor":"camptocamp","product":"mapfish_print"},{"vendor":"mapfish","product":"mapfish-print"},{"vendor":"org.mapfish","product":"print.print-lib"},{"vendor":"org.mapfish","product":"print.print-servlet"}],"references":[{"url":"https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44672","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q7m6-wpvf-mvwx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44672.json","tags":["advisory"]},{"url":"https://github.com/mapfish/mapfish-print","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44672","title":"mapfish-print: Remote Code Injection (RCE) in Dynamic table","description":"mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code  in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.","status":"published","published":"2026-05-28T14:35:29.378Z","modified":"2026-05-28T15:26:01.99Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-32909","description":"mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code  in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.","status":"published","published":"2026-05-28T14:35:29Z","modified":"2026-05-28T15:26:01Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:21:02.581093Z"}],"ghsa":[{"id":"GHSA-q7m6-wpvf-mvwx","title":"Mapfish Print: Remote Code Injection (RCE) in Dynamic table","description":"### Impact\n\nThe attacker can execute arbitrary code without being authenticated\n\n### Mitigation\n\nUpgrade to a patched version (please check affected/patched version matrix)\n\n### Credits\n\nBug Bounty of Canton du Jura","status":"published","published":"2026-05-13T01:35:37Z","modified":"2026-06-09T02:00:09Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:40:22.540562Z"}],"nvd":[{"id":"CVE-2026-44672","description":"mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code  in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.","status":"published","published":"2026-05-28T16:16:24.843Z","modified":"2026-06-17T10:51:13.5Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:21.244426Z"}],"osv":[{"id":"CVE-2026-44672","title":"mapfish-print: Remote Code Injection (RCE) in Dynamic table","description":"mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code  in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.","status":"published","published":"2026-05-28T14:35:29.378Z","modified":"2026-10-28T02:30:28.582581194Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"GHSA-q7m6-wpvf-mvwx","title":"Mapfish Print: Remote Code Injection (RCE) in Dynamic table","description":"### Impact\n\nThe attacker can execute arbitrary code without being authenticated\n\n### Mitigation\n\nUpgrade to a patched version (please check affected/patched version matrix)\n\n### Credits\n\nBug Bounty of Canton du Jura","status":"published","published":"2026-05-13T01:35:37Z","modified":"2026-06-09T02:15:07.546721039Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}