Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported Until
>= 3.29	Unsupported
3.30	27/06/2027
3.31	30/04/2029
3.32	Unsupported
3.33	Unsupported
4.0	Best effort

Reporting a Vulnerability

Please do not open a public GitHub issue to report a vulnerability. Instead, create a new security advisory.

XXE on MapFish Print allows reading arbitrary files of certain types
GHSA-5v29-34h8-v68r published Jun 22, 2026 by sbrunner
High
Remote Code Injection (RCE) in Dynamic table
GHSA-q7m6-wpvf-mvwx published May 8, 2026 by sbrunner
Critical
Address a Spring Framework CVE
GHSA-5f67-qgrr-wmxj published Apr 5, 2022 by sbrunner
Critical
No more used JSONP vulnerabilities
GHSA-w534-q4xf-h5v2 published Jul 6, 2020 by sbrunner
Low
Untrusted XML files
GHSA-vjv6-gq77-3mjw published Jul 6, 2020 by sbrunner
Low

Learn more about advisories related to mapfish/mapfish-print in the GitHub Advisory Database