{"id":"CVE-2026-111398","kind":"vulnerability","aliases":["CVE-2026-111398"],"related":[],"title":"MapSVG WordPress plugin: path traversal through 8.16.1 exposes server files","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1.","summary":"The MapSVG Lite interactive vector maps plugin has a path traversal flaw that lets a request reach files outside its intended directory. An attacker could read files the web server can access, such as configuration files holding secrets.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mapsvg","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `mapsvg-lite-interactive-vector-maps` plugin is installed and its version in the WordPress admin plugin list\n- unknown","fix":"- Update the MapSVG plugin (mapsvg-lite-interactive-vector-maps) to a version later than `8.16.1`\n- unknown","status":"open","published_at":"2026-10-19T10:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:10:53+00:00","updated_at":"2026-10-25T03:10:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:10:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MapSVG plugin (mapsvg-lite-interactive-vector-maps) to a version later than `8.16.1`\n- unknown","reach":"internet","title":"MapSVG WordPress plugin: path traversal through 8.16.1 exposes server files","impact":"medium","summary":"The MapSVG Lite interactive vector maps plugin has a path traversal flaw that lets a request reach files outside its intended directory. An attacker could read files the web server can access, such as configuration files holding secrets.","category":"package","nicknames":[],"who_cares":["wordpress","mapsvg","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads arbitrary server files through the plugin","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and whether authentication is required; the sources give only 'through 8.16.1'.","how_to_check":"- Check whether the `mapsvg-lite-interactive-vector-maps` plugin is installed and its version in the WordPress admin plugin list\n- unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MapSVG Lite plugin at version 8.16.1 or earlier are affected. The sources do not say whether the flaw needs an account or a particular feature enabled, so unknown. Sites that do not have the plugin installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000601,"input_tokens":3327,"output_tokens":537,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111398':13A,16A '-2026':12A,15A '8.16.1':7A,94C 'access':54B 'affect':89C 'allow':85C 'attack':46B 'configur':57B 'could':47B 'cve':11A,14A 'directori':44B,69C 'expos':8A 'file':10A,40B,49B,58B 'flaw':34B 'hold':59B 'host':21B 'improp':61C 'intend':43B 'interact':26B,82C 'issu':88C 'let':36B 'light':76C 'limit':62C 'lite':25B,81C 'map':28B,84C 'mapsvg':1A,17B,24B,78C,80C,90C 'mapsvg-lite-interactive-vector-map':79C 'n/a':92C 'norther':75C 'outsid':41B 'packag':18B 'path':4A,32B,70C,86C 'pathnam':65C 'plugin':3A,29B 'product':77C 'pt':74C 'reach':39B 'read':48B 'request':38B 'restrict':68C 'secret':60B 'self':20B 'self-host':19B 'server':9A,52B 'travers':5A,33B,71C 'traversal.this':87C 'vector':27B,83C 'vulner':72C 'web':51B 'wordpress':2A,22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MapSVG Lite plugin at version 8.16.1 or earlier are affected. The sources do not say whether the flaw needs an account or a particular feature enabled, so unknown. Sites that do not have the plugin installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111398","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111398","severity":null,"published_at":"2026-10-19T10:16:45+00:00","modified_at":"2026-10-19T18:16:59+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}