CVE-2026-44672: Mapfish Print: Remote Code Injection (RCE) in Dynamic table
Impact The attacker can execute arbitrary code without being authenticated Mitigation Upgrade to a patched version (please check affected/patched version matrix) Credits Bug Bounty of Canton du Jura
Published May 13, 2026 · Updated Jun 9, 2026
Affected packages
org.mapfish.print:print-lib
- Ecosystem
- Maven
- Affected
- >= 3.23.0, < 3.28.28
- Fixed in
- 3.28.28
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-lib
org.mapfish.print:print-lib
- Ecosystem
- Maven
- Affected
- >= 3.29.0, < 3.30.30
- Fixed in
- 3.30.30
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-lib
org.mapfish.print:print-lib
- Ecosystem
- Maven
- Affected
- >= 3.31.0, < 3.31.21
- Fixed in
- 3.31.21
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-lib
org.mapfish.print:print-lib
- Ecosystem
- Maven
- Affected
- >= 3.32.0, < 3.33.14
- Fixed in
- 3.33.14
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-lib
org.mapfish.print:print-lib
- Ecosystem
- Maven
- Affected
- >= 3.34.0, < 4.0.3
- Fixed in
- 4.0.3
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-lib
org.mapfish.print:print-servlet
- Ecosystem
- Maven
- Affected
- >= 3.23.0, < 3.28.28
- Fixed in
- 3.28.28
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-servlet
org.mapfish.print:print-servlet
- Ecosystem
- Maven
- Affected
- >= 3.29.0, < 3.30.30
- Fixed in
- 3.30.30
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-servlet
org.mapfish.print:print-servlet
- Ecosystem
- Maven
- Affected
- >= 3.31.0, < 3.31.21
- Fixed in
- 3.31.21
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-servlet
org.mapfish.print:print-servlet
- Ecosystem
- Maven
- Affected
- >= 3.32.0, < 3.33.14
- Fixed in
- 3.33.14
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-servlet
org.mapfish.print:print-servlet
- Ecosystem
- Maven
- Affected
- >= 3.34.0, < 4.0.3
- Fixed in
- 4.0.3
- Check
mvn dependency:tree -Dincludes=org.mapfish.print:print-servlet
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
The attacker can execute arbitrary code without being authenticated
Mitigation
Upgrade to a patched version (please check affected/patched version matrix)
Credits
Bug Bounty of Canton du Jura
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology