Mapfish Print: Remote Code Injection (RCE) in Dynamic table
The attacker can execute arbitrary code without being authenticated
Advisories for Maven/Org.mapfish.print/Print-Servlet package
2026
2020
Improper Restriction of XML External Entity Reference
In mapfish-print, an attacker can run an XML External Entity (XXE) attack with the provided SDL style.
Cross-site Scripting
In mapfish-print, a user can use the JSONP support to do a Cross-site scripting.