{"id":"CVE-2026-55848","summary":"mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types","details":"mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java without disabling external entities and external DTDs. A remote XML document and DTD can expand a local file entity, and the resulting content can be exposed through the GML parsing and error path. This allows unauthenticated attackers to read files such as operating-system account data, Kubernetes service-account tokens, and certificates. Replacing the file entity target with an internal HTTP endpoint also permits server-side request forgery. This issue is fixed in versions 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5.","aliases":["GHSA-5v29-34h8-v68r"],"modified":"2026-09-11T08:38:02.125006Z","published":"2026-08-28T22:31:26.705Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-611"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55848.json"},"references":[{"type":"WEB","url":"https://github.com/mapfish/mapfish-print/releases/tag/3.28.30"},{"type":"WEB","url":"https://github.com/mapfish/mapfish-print/releases/tag/3.30.32"},{"type":"WEB","url":"https://github.com/mapfish/mapfish-print/releases/tag/3.31.24"},{"type":"WEB","url":"https://github.com/mapfish/mapfish-print/releases/tag/4.0.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55848.json"},{"type":"ADVISORY","url":"https://github.com/mapfish/mapfish-print/security/advisories/GHSA-5v29-34h8-v68r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55848"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/pull/4212"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/pull/4215"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/pull/4216"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/pull/4217"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/pull/4219"},{"type":"FIX","url":"https://github.com/mapfish/mapfish-print/pull/4221"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mapfish/mapfish-print","events":[{"introduced":"4cbdc47c7e96ac47108806e8ea11d6da8bfcbdfc"},{"introduced":"0"},{"introduced":"b4183098cf4df8e3baffdcb2757bb1f0a6c76853"},{"introduced":"8d40689f579921a1e8cc217fb96dff216924408e"},{"fixed":"cc2528102837a6034470f2bf7e08e6181ed62d7d"},{"fixed":"f199a1d934cefc514fadf3c669e37283f3affd13"},{"fixed":"72159c9881aaf6b0352a977017c4e40f261b4553"},{"fixed":"c46a36e99e648994358832782875895334b1868d"},{"fixed":"60ab2dc4bb49d6cda4210bbe62a3fb9ceeef8c87"},{"fixed":"13beae7a7f970fc3526c1f7ca5db817d8d51fbec"},{"fixed":"23a96e7baa15077bdb0e5fc5a72b18da23af9121"},{"fixed":"3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"},{"fixed":"56c47d3bf70d8428916dea8ed7005518ad07dc7d"},{"fixed":"a55a24873db5f19b37abac7d59144dc86406c236"},{"fixed":"d13911ac6e0509444d64e74830f10b14e4dcfdf1"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.28.30"},{"introduced":"3.29.0"},{"fixed":"3.30.32"},{"introduced":"3.31.0"},{"fixed":"3.31.24"},{"introduced":"3.32.0"},{"fixed":"3.33.16"},{"introduced":"4.0.0"},{"fixed":"4.0.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["3.30.30","3.30.31","3.28.29","3.31.23","4.0.4","3.33.15","4.0.3","3.31.22","3.33.14","3.28.28","3.30.29","3.28.27","3.33.13","3.31.21","4.0.2","3.30.28","4.0.1","3.31.20","3.33.12","3.28.26","4.0.0","3.30.27","3.28.25","3.33.11","3.31.19","3.33.10","3.30.26","3.28.24","3.31.18","3.33.9","3.30.25","3.28.23","3.31.17","3.33.8","3.31.16","3.30.24","3.33.7","3.28.22","3.33.6","3.30.23","3.28.21","3.33.5","3.31.15","3.28.20","3.31.14","3.33.4","3.30.22","3.33.3","3.28.19","3.31.13","3.30.21","3.33.2","3.30.20","3.28.18","3.33.1","3.31.12","3.30.19","3.33.0","3.28.17","3.31.11","3.32.0","3.30.18","3.28.16","3.31.10","3.30.17","3.28.15","3.31.5","3.31.9","3.30.16","3.28.14","3.31.8","3.28.13","3.31.7","3.30.15","3.28.12","3.30.14","3.31.6","3.30.13","3.28.11","3.31.4","3.30.12","3.31.3","3.31.2","3.28.10","3.31.1","3.30.11","3.28.9","3.28.8","3.30.10","3.30.7","3.30.6","3.28.6","3.30.5","3.30.3","3.30.2","3.30.1","3.30.0","release/3.23","3.23.0","3.28.5","release/3.28.4","3.28.4","3.28.3","release/3.27.0","3.27.0","release/3.28.1","3.28.1","release/3.28.0","3.28.0","release/3.25.0","release/3.24.0","3.24.0","release/3.23.0","release/3.22.0","release/3.19.1","release/3.18.4","release/3.17.0","release/3.16.2","release/3.15.0","release/3.21.0","release/3.20.1","release/3.20.0","release/3.19.0","release/3.18.3","release/3.18.2","release/3.18.1","release/3.18.0","release/3.16.1","release/3.16.0","release/3.14.1","release/3.14.0","release/3.13.0","release/3.12.1","release/3.12.0","release/3.11.3","release/3.11.2","release/3.11.1","release/3.11.0","release/3.10.2","release/3.10.1","release/3.10.0","release/3.7.0","release/3.9.0","release/3.8.0","release/3.6.0","release/3.5.0","release/3.4.0","release/3.3.0","release/3.2.0","release/3.1.2","release/3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-55848.json","vanir_signatures_modified":"2026-09-11T08:38:02Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"parseGml32"},"deprecated":false,"digest":{"function_hash":"51201055360594419095161873744536223162","length":530},"id":"CVE-2026-55848-11151206"},{"digest":{"function_hash":"195185026277342325283261709885818973797","length":617},"id":"CVE-2026-55848-1887e4dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createFeatureSource"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createParser"},"deprecated":false,"digest":{"function_hash":"125294633619954804873910824503143439555","length":158},"id":"CVE-2026-55848-42dba81f"},{"target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java"},"deprecated":false,"digest":{"line_hashes":["163633157266316065502035152252023754714","81162266360558145293629340617432375243","49328191890453188466476086211211314858","338935507404355852554232444201699988139","239476002142188140295812932565203287925","176785493097384977716025733081731350096","291807634965892003993228360953730873308","283287785833665515714891483831737219008","139305204441850117635066028246177979005","66234815819174036881791336468302878869","101409028053569303283567498788130950900","67472274274865148687111194550581558510","271130944787354806241551286729924074075","153012663640334355295452479997426155606","237370680633170078175262674214034996199","64338717651286691215334019949766257604","182973001933487521169270041922847028782","329388903860286839353624008002679089392","214635133117659624323054964087847036042","206374300743938481548528140732689447867","216699480220117436146554044563606300710","206676270267324879186938091201069252338","244997340631995896878271934409673883884"],"threshold":0.9},"id":"CVE-2026-55848-446e517a","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121"},{"target":{"function":"createParser","file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false,"digest":{"function_hash":"125294633619954804873910824503143439555","length":158},"id":"CVE-2026-55848-48f8c79d","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d"},{"digest":{"function_hash":"229451948922567545167258984080766558844","length":656},"id":"CVE-2026-55848-5a5a98ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createFeatureSource"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["163633157266316065502035152252023754714","81162266360558145293629340617432375243","49328191890453188466476086211211314858","338935507404355852554232444201699988139","239476002142188140295812932565203287925","176785493097384977716025733081731350096","291807634965892003993228360953730873308","283287785833665515714891483831737219008","139305204441850117635066028246177979005","66234815819174036881791336468302878869","101409028053569303283567498788130950900","67472274274865148687111194550581558510","271130944787354806241551286729924074075","153012663640334355295452479997426155606","237370680633170078175262674214034996199","64338717651286691215334019949766257604","182973001933487521169270041922847028782","329388903860286839353624008002679089392","214635133117659624323054964087847036042","206374300743938481548528140732689447867","216699480220117436146554044563606300710","206676270267324879186938091201069252338","244997340631995896878271934409673883884"]},"id":"CVE-2026-55848-5dea4bd8","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java"},"deprecated":false},{"digest":{"line_hashes":["191576459408128436716517749706947647462","92977572872661860319907587034158304719","105849366008326991635962860390114475014","17776144042886740007812455635665810826","116279944345318808688487306904094610310","44280431546427163739457944096371012176","78441538318540827670528957028987664636","165182502875180138353608255795630550587","65203677376255311410034819225780978156","22390630643028373243981609661686385019","209977540393687353209505186875837275320","1225326047959913397257593888094057207","288088774913140770539340817948894612255","94889674952363208085041608578576946184","74054238543478175381002597855760869307","23801819148861859451187586561432013993","161991591278168604035388683834513592758","57878476572516054715174116937363701452","102541431545414159281643839734811644679","133130066318172242839254507575460990557","200680627525110319978041089971680947314","96212698008482663237588757706549956559","180745724850430771911090358764049926039","70844822130813640520224426123638150016","263457502774861578937216211463892123091","75342672948620425907427504394692152834","171971084891908402564067458537726513010","188294609664736925234629852469775500269","52356490103645595708745015436290967437","318333062755731460811667817550370560614","59584525237061598498630579075606619273"],"threshold":0.9},"id":"CVE-2026-55848-71ec8a30","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false},{"id":"CVE-2026-55848-8c88c813","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"parseGml32"},"deprecated":false,"digest":{"function_hash":"228045350064101682200974053218811722292","length":515}},{"deprecated":false,"digest":{"line_hashes":["16617191984085863021501777911228640787","17642667562586673563341042057847886861","49328191890453188466476086211211314858","338935507404355852554232444201699988139","239476002142188140295812932565203287925","176785493097384977716025733081731350096","277910914543615960338699741874419230221","89695751390589644814649678489968734709","49468083952944315059289311589459470955","283287785833665515714891483831737219008","139305204441850117635066028246177979005","132750016426464223853992495711544144699","112499265657789603152883213974283133185","274225534077517064158065579700026233139","334415614220238316123233902396574584419","153012663640334355295452479997426155606","237370680633170078175262674214034996199","64338717651286691215334019949766257604","263897002729373612282124584020948660393","246317526099029611922637011088522707767","65509393328161976456320927865108961836","280003918191067177954970016356816543945","250972459889609135804328124868119018762","128199340512293802227231221596996597656"],"threshold":0.9},"id":"CVE-2026-55848-a5305344","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false,"digest":{"line_hashes":["225734047254654958522323696623203759770","204525738643075198312877327685265244086","253045581637593767554852348117826305979","227710371139969389124425211858502551835","335489467500114100285583035505859708664","68981592984691858862946700409656884380","84655102161562065592799694989366971440","200678148686987737008780093049040191780","22390630643028373243981609661686385019","209977540393687353209505186875837275320","1225326047959913397257593888094057207","288088774913140770539340817948894612255","94889674952363208085041608578576946184","74054238543478175381002597855760869307","247821313526363524404606010452140587622","161991591278168604035388683834513592758","57878476572516054715174116937363701452","102541431545414159281643839734811644679","133130066318172242839254507575460990557","200680627525110319978041089971680947314","96212698008482663237588757706549956559","180745724850430771911090358764049926039","70844822130813640520224426123638150016","263457502774861578937216211463892123091","75342672948620425907427504394692152834","171971084891908402564067458537726513010","227619137736854553012004619960851750528","243614680360498893229828397626142156890","87658896803675081595666054643862093871","113044383102372168369087746024266096291"],"threshold":0.9},"id":"CVE-2026-55848-a6dad7a7"},{"source":"https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java"},"deprecated":false,"digest":{"line_hashes":["163005366264070537192216245583724548716"],"threshold":0.9},"id":"CVE-2026-55848-aa6efec7","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createFeatureSource"},"deprecated":false,"digest":{"function_hash":"195185026277342325283261709885818973797","length":617},"id":"CVE-2026-55848-aa7ad603","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["34591090800654937944881338003690677913","209977540393687353209505186875837275320","1225326047959913397257593888094057207","93890832097545530709218055346706192539","152559431246589473662456477024835042659","50005872332880171280688985849190402954","225374689806544382050056548759623004815","200680627525110319978041089971680947314","96212698008482663237588757706549956559","73444631021147512596869457169422935490","216754798550015668519614296725791047656","171971084891908402564067458537726513010","227619137736854553012004619960851750528","243614680360498893229828397626142156890","87658896803675081595666054643862093871","113044383102372168369087746024266096291"]},"id":"CVE-2026-55848-b940ac34","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"35480247813598537718587142406278685184","length":1436},"id":"CVE-2026-55848-bb49cde8","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java","function":"testExecute"}},{"target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createParser"},"deprecated":false,"digest":{"function_hash":"334919647129096993303209038565232285371","length":154},"id":"CVE-2026-55848-bec8bbbb","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1"},{"deprecated":false,"digest":{"line_hashes":["163005366264070537192216245583724548716"],"threshold":0.9},"id":"CVE-2026-55848-c99373de","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java"}},{"source":"https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java","function":"testExecute"},"deprecated":false,"digest":{"function_hash":"35480247813598537718587142406278685184","length":1436},"id":"CVE-2026-55848-ca0a7c43","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-55848-cfbbd3e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"parseGml32"},"deprecated":false,"digest":{"function_hash":"304243499230746154480431950850282559229","length":537}},{"digest":{"function_hash":"229451948922567545167258984080766558844","length":656},"id":"CVE-2026-55848-d21edb6b","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1","target":{"function":"createFeatureSource","file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false},{"deprecated":false,"digest":{"length":154,"function_hash":"334919647129096993303209038565232285371"},"id":"CVE-2026-55848-d804fa77","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createParser"}},{"deprecated":false,"digest":{"function_hash":"304243499230746154480431950850282559229","length":537},"id":"CVE-2026-55848-da692558","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"parseGml32"}},{"target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createParser"},"deprecated":false,"digest":{"function_hash":"125294633619954804873910824503143439555","length":158},"id":"CVE-2026-55848-dd94ff58","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/13beae7a7f970fc3526c1f7ca5db817d8d51fbec"},{"id":"CVE-2026-55848-df39772e","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/d13911ac6e0509444d64e74830f10b14e4dcfdf1","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"parseGml32"},"deprecated":false,"digest":{"function_hash":"304243499230746154480431950850282559229","length":537}},{"target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false,"digest":{"line_hashes":["225734047254654958522323696623203759770","204525738643075198312877327685265244086","253045581637593767554852348117826305979","227710371139969389124425211858502551835","335489467500114100285583035505859708664","68981592984691858862946700409656884380","84655102161562065592799694989366971440","200678148686987737008780093049040191780","22390630643028373243981609661686385019","209977540393687353209505186875837275320","1225326047959913397257593888094057207","288088774913140770539340817948894612255","94889674952363208085041608578576946184","74054238543478175381002597855760869307","247821313526363524404606010452140587622","161991591278168604035388683834513592758","57878476572516054715174116937363701452","102541431545414159281643839734811644679","133130066318172242839254507575460990557","200680627525110319978041089971680947314","96212698008482663237588757706549956559","180745724850430771911090358764049926039","70844822130813640520224426123638150016","263457502774861578937216211463892123091","75342672948620425907427504394692152834","171971084891908402564067458537726513010","227619137736854553012004619960851750528","243614680360498893229828397626142156890","87658896803675081595666054643862093871","113044383102372168369087746024266096291"],"threshold":0.9},"id":"CVE-2026-55848-df6ee204","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb"},{"digest":{"function_hash":"304243499230746154480431950850282559229","length":537},"id":"CVE-2026-55848-e1078b8d","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"parseGml32"},"deprecated":false},{"target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java","function":"createParser"},"deprecated":false,"digest":{"function_hash":"125294633619954804873910824503143439555","length":158},"id":"CVE-2026-55848-e54f1e9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236"},{"deprecated":false,"digest":{"line_hashes":["16617191984085863021501777911228640787","17642667562586673563341042057847886861","49328191890453188466476086211211314858","338935507404355852554232444201699988139","239476002142188140295812932565203287925","176785493097384977716025733081731350096","291807634965892003993228360953730873308","250972459889609135804328124868119018762","128199340512293802227231221596996597656"],"threshold":0.9},"id":"CVE-2026-55848-ea365108","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/56c47d3bf70d8428916dea8ed7005518ad07dc7d","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/3525e8150fcb5f40095930ccf7aec0d8ce92bbcb","target":{"file":"core/src/test/java/org/mapfish/print/processor/map/CreateMapProcessorFlexibleScaleBBoxGmlTest.java","function":"testExecute"},"deprecated":false,"digest":{"function_hash":"9605889520395208386417332878758692454","length":1427},"id":"CVE-2026-55848-f0983fc4"},{"digest":{"line_hashes":["34591090800654937944881338003690677913","209977540393687353209505186875837275320","1225326047959913397257593888094057207","93890832097545530709218055346706192539","152559431246589473662456477024835042659","50005872332880171280688985849190402954","133130066318172242839254507575460990557","200680627525110319978041089971680947314","96212698008482663237588757706549956559","73444631021147512596869457169422935490","216754798550015668519614296725791047656","171971084891908402564067458537726513010","227619137736854553012004619960851750528","243614680360498893229828397626142156890","87658896803675081595666054643862093871","113044383102372168369087746024266096291"],"threshold":0.9},"id":"CVE-2026-55848-f318e41c","signature_type":"Line","signature_version":"v1","source":"https://github.com/mapfish/mapfish-print/commit/a55a24873db5f19b37abac7d59144dc86406c236","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false},{"source":"https://github.com/mapfish/mapfish-print/commit/23a96e7baa15077bdb0e5fc5a72b18da23af9121","target":{"file":"core/src/main/java/org/mapfish/print/map/geotools/GmlLayer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["191576459408128436716517749706947647462","92977572872661860319907587034158304719","105849366008326991635962860390114475014","17776144042886740007812455635665810826","116279944345318808688487306904094610310","44280431546427163739457944096371012176","78441538318540827670528957028987664636","165182502875180138353608255795630550587","65203677376255311410034819225780978156","22390630643028373243981609661686385019","209977540393687353209505186875837275320","1225326047959913397257593888094057207","288088774913140770539340817948894612255","94889674952363208085041608578576946184","74054238543478175381002597855760869307","23801819148861859451187586561432013993","161991591278168604035388683834513592758","57878476572516054715174116937363701452","102541431545414159281643839734811644679","133130066318172242839254507575460990557","200680627525110319978041089971680947314","96212698008482663237588757706549956559","180745724850430771911090358764049926039","70844822130813640520224426123638150016","263457502774861578937216211463892123091","75342672948620425907427504394692152834","171971084891908402564067458537726513010","188294609664736925234629852469775500269","52356490103645595708745015436290967437","318333062755731460811667817550370560614","59584525237061598498630579075606619273"]},"id":"CVE-2026-55848-f6920c1c","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}