PT-2026-40588 · Unknown · Mapfish-Print

Sbrunner · Published 2026-05-13 · Updated 2026-05-28 · CVE-2026-44672

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mapfish Print versions prior to 3.28.28 Mapfish Print versions prior to 3.30.30 Mapfish Print versions prior to 3.31.21 Mapfish Print versions prior to 3.33.14 Mapfish Print versions prior to 4.0.3

Description A critical flaw in dynamic table generation allows unauthenticated attackers to supply crafted external inputs that are improperly neutralized and executed as system code. This enables remote code execution (RCE), which is the ability to run arbitrary commands on a target machine, granting attackers full control over the compromised server.

Recommendations Upgrade to version 3.28.28. Upgrade to version 3.30.30. Upgrade to version 3.31.21. Upgrade to version 3.33.14. Upgrade to version 4.0.3.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-44672

GHSA-Q7M6-WPVF-MVWX

Affected Products

Mapfish-Print

References · 6

• https://osv.dev/vulnerability/GHSA-q7m6-wpvf-mvwx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44672 · Security Note
• https://github.com/mapfish/mapfish-print/security/advisories/GHSA-q7m6-wpvf-mvwx · Note
• https://github.com/mapfish/mapfish-print · Note
• https://reddit.com/r/VulnMatter/comments/1tcwxup/resumen_diario_de_vulnerabilidades_14052026 · Reddit Post
• https://twitter.com/UpwindMDR/status/2054446948451602715 · Twitter Post