CVE-2026-44672 - Vulnerability Details - OpenCVE

mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx

History

Thu, 28 May 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 28 May 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.
Title		mapfish-print: Remote Code Injection (RCE) in Dynamic table
Weaknesses		CWE-94
References		https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-05-28T14:35:29.378Z

Updated: 2026-05-28T15:26:01.990Z

Reserved: 2026-05-07T16:20:08.659Z

Link: CVE-2026-44672

Vulnrichment

Updated: 2026-05-28T15:25:54.912Z

NVD

Status : Received

Published: 2026-05-28T16:16:24.843

Modified: 2026-05-28T16:16:24.843

Link: CVE-2026-44672

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-05-28T16:30:15Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44672", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T16:20:08.659Z", "datePublished": "2026-05-28T14:35:29.378Z", "dateUpdated": "2026-05-28T15:26:01.990Z"}, "containers": {"cna": {"title": "mapfish-print: Remote Code Injection (RCE) in Dynamic table", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx"}], "affected": [{"vendor": "mapfish", "product": "mapfish-print", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}, {"vendor": "camptocamp", "product": "mapfish_print", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}, {"vendor": "org.mapfish", "product": "print.print-lib", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}, {"vendor": "org.mapfish", "product": "print.print-servlet", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T14:35:29.378Z"}, "descriptions": [{"lang": "en", "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3."}], "source": {"advisory": "GHSA-q7m6-wpvf-mvwx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T15:25:47.863126Z", "id": "CVE-2026-44672", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T15:26:01.990Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44672", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T16:20:08.659Z", "datePublished": "2026-05-28T14:35:29.378Z", "dateUpdated": "2026-05-28T15:26:01.990Z"}, "containers": {"cna": {"title": "mapfish-print: Remote Code Injection (RCE) in Dynamic table", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx"}], "affected": [{"vendor": "mapfish", "product": "mapfish-print", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}, {"vendor": "camptocamp", "product": "mapfish_print", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}, {"vendor": "org.mapfish", "product": "print.print-lib", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}, {"vendor": "org.mapfish", "product": "print.print-servlet", "versions": [{"version": ">= 3.23.0, < 3.28.28", "status": "affected"}, {"version": ">= 3.29.0, < 3.30.30", "status": "affected"}, {"version": ">= 3.31.0, < 3.31.21", "status": "affected"}, {"version": ">= 3.32.0, < 3.33.14", "status": "affected"}, {"version": ">= 3.34.0, < 4.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T14:35:29.378Z"}, "descriptions": [{"lang": "en", "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3."}], "source": {"advisory": "GHSA-q7m6-wpvf-mvwx", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44672", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T15:25:47.863126Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T15:25:54.912Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3."}], "id": "CVE-2026-44672", "lastModified": "2026-05-28T16:16:24.843", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-05-28T16:16:24.843", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Primary"}]}