Kurz gesagt
- CVE-2026-44672 ist eine Schwachstelle (KRITISCH (CVSS 9.3)) in org.mapfish.print:print-lib, org.mapfish.print:print-servlet.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.33%, höher als bei 25.6% aller Schwachstellen.
- Abhilfe: auf 3.28.28, 3.30.30, 3.31.21, 3.33.14 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| org.mapfish.print:print-lib Maven | ≥ 3.23.0, < 3.28.28≥ 3.29.0, < 3.30.30≥ 3.31.0, < 3.31.21≥ 3.32.0, < 3.33.14≥ 3.34.0, < 4.0.3
| 3.28.283.30.303.31.213.33.144.0.3
|
| org.mapfish.print:print-servlet Maven | ≥ 3.23.0, < 3.28.28≥ 3.29.0, < 3.30.30≥ 3.31.0, < 3.31.21≥ 3.32.0, < 3.33.14≥ 3.34.0, < 4.0.3
| 3.28.283.30.303.31.213.33.144.0.3
|
Description
Impact
The attacker can execute arbitrary code without being authenticated
Mitigation
Upgrade to a patched version (please check affected/patched version matrix)
Credits
Bug Bounty of Canton du Jura
NVD description
mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free