Arbitrary code execution is possible through the Dynamic Table functionality of the MapFish Print component, which is used for rendering templated cartographic maps. The vulnerability is a form of code injection (CWE‑94) and allows an unauthenticated attacker to supply malicious input that is executed on the server side. The lack of authentication requirements and the breadth of the code injection capability mean that a successful exploit can compromise the entire hosting environment, leading to complete loss of confidentiality, integrity, and availability.

Affected are the MapFish Print products from the vendors camptocamp, mapfish, and org.mapfish. The vulnerability applies to MapFish Print versions from 3.23.0 through 3.28.27, 3.30.0 through 3.30.29, 3.31.0 through 3.31.21, 3.33.0 through 3.33.13, and 4.0.0 through 4.0.2. All of these versions are remediated in versions 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3.

The CVSS score of 9.3 indicates critical severity. Although an EPSS score is not available, the absence of authentication checks and the high impact of code injection suggest that exploitation could occur frequently if the vulnerable component is exposed to the internet. The vulnerability is not listed in the CISA KEV catalog, but its potential for unprivileged remote code execution makes it a high priority for remediation.