Live › vulnerability › CVE-2026-111406
Go to dashboardMapSVG (mapsvg-lite-interactive-vector-maps), a WordPress-style interactive map plugin by PT Norther Lights Production, lets users upload files of dangerous types without restriction. An attacker can upload a web shell to the web server and run commands on it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed MapSVG version (versions up to and including 8.16.1 are affected) in the plugin's header or package metadata.
8.16.1; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-111406")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.