CVE-2026-111398

CVE-2026-111398 · WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.

CVSS 7.7 · High · EPSS 0.3% · Fix available

Published: 2026-10-19T09:09:19.440Z
Updated: 2026-10-19T17:17:11.133Z

Affected products and versions

mapsvg
Versions
- ≥ 0, ≤ 8.16.1: Affected; ≥ 8.16.2: Not affected (custom)
Update to 8.16.2

Original sources

https://patchstack.com/database/wordpress/plugin/mapsvg-lite-interactive-vector-maps/vulnerability/wordpress-mapsvg-plugin-8-16-1-arbitrary-file-deletion-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-111398

Check your server →