MavenPackage

org.mapfish.print:print-lib

4 known vulnerabilities (3 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release: 3.22.0 (Jan 7, 2020): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 4 · 3 critical, 1 high

Version timeline

CVE-2026-55848
Affects 3.0 to 3.22.0 (through the newest release)
CVE-2026-44672
No published release is affected
No published release is affected
CVE-2020-15232
Affects 3.0 to 3.22.0 (through the newest release)
CVE-2020-15231
Affects 1.2.0 to 3.22.0 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-55848High 8.6
mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types
Affected: from 3.0.0, fixed in 3.28.30; from 3.29.0, fixed in 3.30.32; from 3.32.0, fixed in 3.33.16; from 3.34.0, fixed in 4.0.5.
No fix released. The advisory names 3.28.30 and 3.30.32 and 3.33.16 and 4.0.5 as the fix, which the registry doesn't have yet. The latest release, 3.22.0, is still affected.
CVE-2026-44672Critical 9.3
mapfish-print: Remote Code Injection (RCE) in Dynamic table
Affected: from 3.23.0, fixed in 3.28.28; from 3.29.0, fixed in 3.30.30; from 3.31.0, fixed in 3.31.21; from 3.32.0, fixed in 3.33.14; from 3.34.0, fixed in 4.0.3.
No fix released. The advisory names 3.28.28 and 3.30.30 and 3.31.21 and 3.33.14 and 4.0.3 as the fix, which the registry doesn't have yet.
CVE-2020-15232Critical 9.3
XML External Entity attack in mapfish-print
Affected: from 3.0, fixed in 3.24.
No fix released. The advisory names 3.24 as the fix, which the registry doesn't have yet. The latest release, 3.22.0, is still affected.
CVE-2020-15231Critical 9.3
Cross-site scripting attack in mapfish-print
Affected: fixed in 3.24.
No fix released. The advisory names 3.24 as the fix, which the registry doesn't have yet. The latest release, 3.22.0, is still affected.