CVE-2026-44672

mapfish-print: Remote Code Injection (RCE) in Dynamic table

CVSS 9.3 CRITICALEPSS 0.3%CWE-94

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

28 mai 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

camptocamp · mapfish_print mapfish · mapfish-print org.mapfish · print.print-lib org.mapfish · print.print-servlet

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx