CVE-2026-44672: mapfish-print: Remote Code Injection (RCE) in Dynamic table

Synopsis

Remote code execution (RCE) vulnerability in mapfish-print, a cartographic map-printing component of the MapFish framework. The flaw is reachable over the network with no authentication required, through the Dynamic table feature, and allows an attacker to execute arbitrary code on the host running the affected service. Patched versions (3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3) have been published, and patched-image rebuilds are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the mapfish-print service via HTTP/HTTPS to trigger the flaw.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the Dynamic table code-injection path is fully unauthenticated.

• Victim interactionNot required

  The attacker sends a crafted request directly to the service; no user action or social engineering is involved.

• Attack complexityDetail

  Exploit reliability is high and condition-free: no race conditions, special memory layout, or environmental prerequisites are required (AC:L, AT:N).

Blast Radius

• Attacker executes arbitrary code in the context of the mapfish-print service process, gaining the same OS-level permissions as that process.
• All data accessible to the service process (map templates, print job data, local filesystem paths) is readable by the attacker.
• The attacker can write or modify files and configuration accessible to the process, potentially corrupting print output or planting persistent payloads.
• The service itself can be crashed or monopolized, denying legitimate map-printing functionality to dependent applications.