MavenPackage

org.mapfish.print:print-servlet

4 known vulnerabilities (3 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release: 3.22.0 (Jan 7, 2020): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 4 · 3 critical, 1 high

Version timeline

CVE-2026-55848
No published release is affected
No published release is affected
CVE-2026-44672
No published release is affected
No published release is affected
CVE-2020-15232
Affects 3.0 to 3.22.0 (through the newest release)
CVE-2020-15231
Affects 1.2.0 to 3.22.0 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-55848High 8.6
mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types
Affected: from 3.29.0, fixed in 3.30.32; from 3.31.0, fixed in 3.31.24; from 3.32.0, fixed in 3.33.16; from 3.34.0, fixed in 4.0.5.
No fix released. The advisory names 3.30.32 and 3.31.24 and 3.33.16 and 4.0.5 as the fix, which the registry doesn't have yet.
CVE-2026-44672Critical 9.3
mapfish-print: Remote Code Injection (RCE) in Dynamic table
Affected: from 3.23.0, fixed in 3.28.28; from 3.29.0, fixed in 3.30.30; from 3.31.0, fixed in 3.31.21; from 3.32.0, fixed in 3.33.14; from 3.34.0, fixed in 4.0.3.
No fix released. The advisory names 3.28.28 and 3.30.30 and 3.31.21 and 3.33.14 and 4.0.3 as the fix, which the registry doesn't have yet.
CVE-2020-15232Critical 9.3
XML External Entity attack in mapfish-print
Affected: from 3.0, fixed in 3.24.
No fix released. The advisory names 3.24 as the fix, which the registry doesn't have yet. The latest release, 3.22.0, is still affected.
CVE-2020-15231Critical 9.3
Cross-site scripting attack in mapfish-print
Affected: fixed in 3.24.
No fix released. The advisory names 3.24 as the fix, which the registry doesn't have yet. The latest release, 3.22.0, is still affected.