Critical severity · published May 28, 2026
CVE-2026-44672
mapfish-print: Remote Code Injection (RCE) in Dynamic table
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
mapfish-print · mapfish
>= 3.23.0, < 3.28.28; >= 3.29.0, < 3.30.30; >= 3.31.0, < 3.31.21; >= 3.32.0, < 3.33.14; >= 3.34.0, < 4.0.3 · source: vendor
MA
mapfish_print · camptocamp
>= 3.23.0, < 3.28.28; >= 3.29.0, < 3.30.30; >= 3.31.0, < 3.31.21; >= 3.32.0, < 3.33.14; >= 3.34.0, < 4.0.3 · source: vendor
PR
print.print-lib · org.mapfish
>= 3.23.0, < 3.28.28; >= 3.29.0, < 3.30.30; >= 3.31.0, < 3.31.21; >= 3.32.0, < 3.33.14; >= 3.34.0, < 4.0.3 · source: vendor
PR
print.print-servlet · org.mapfish
>= 3.23.0, < 3.28.28; >= 3.29.0, < 3.30.30; >= 3.31.0, < 3.31.21; >= 3.32.0, < 3.33.14; >= 3.34.0, < 4.0.3 · source: vendor