Critical MapSVG Bug Through v8.16.1 Enables Web Shell Uploads

Attackers who find a system running the MapSVG product can upload malicious files directly to the web server. This capability allows them to install a web shell, which serves as a persistent backdoor for remote control. The National Vulnerability Database lists this issue as CVE-2026-111406. The flaw is present in the mapsvg-lite-interactive-vector-maps component developed by PT Norther Lights Production. The record indicates that the vulnerability exists in all versions of the product up to and including version 8.16.1.

In plain English

The MapSVG product is designed to help users display interactive vector maps. However, a flaw in how it handles file uploads creates a serious security risk. Instead of restricting uploads to safe formats, the system allows dangerous executable files to be placed on the server. Once an attacker uploads a web shell, they can execute commands on the server. This bypasses standard user permissions and gives the attacker control over the compromised system. The National Vulnerability Database describes this as an unrestricted upload of a file with a dangerous type.

The background

The National Vulnerability Database classifies this issue under CWE-434, which stands for Unrestricted Upload of File with Dangerous Type. This category of weakness occurs when an application accepts file uploads without properly validating the file type or content. The record indicates that the vulnerability affects MapSVG from its earliest available version through 8.16.1. The severity is marked as critical due to the high impact of the potential remote code execution. The source material does not specify if earlier versions are safe, only that the issue affects versions through 8.16.1.

What changes now

System administrators using MapSVG must assume their installations are vulnerable if they are running version 8.16.1 or earlier. The National Vulnerability Database record does not indicate that a patched version has been released yet. Until PT Norther Lights Production provides an update, users remain exposed to this specific upload flaw. Security teams should monitor the vendor’s official channels for a confirmed fix. In the meantime, the risk of unauthorized web shell installation remains active for all affected installations.

What made it possible

This incident stems from a failure in input validation during file handling. Applications that accept user-uploaded content must strictly enforce allowlists for file extensions and magic numbers. Without these checks, attackers can disguise malicious scripts as benign files. This weakness typically serves the initial access or persistence phase of an intrusion, granting attackers direct server-side execution capabilities. Teams usually mitigate such risks by configuring web servers to deny execution in upload directories and by implementing strict content-type verification before storing files.

What to do and how to stay safe: MapSVG

• Audit your installations to identify any systems using MapSVG version 8.16.1 or earlier.
• Monitor the vendor’s official website and security advisories for a confirmed patch release.
• Review server logs for unusual file upload activity or new executable files in plugin directories.
• Consider temporarily disabling the product if it is not critical to your system’s immediate operations.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this MapSVG vulnerability?

The National Vulnerability Database assigns a CVSS score of 9.9, rating it as critical severity.

Which versions of MapSVG are affected by CVE-2026-111406?

The vulnerability affects all versions of MapSVG from the initial release through version 8.16.1.

Is there a patch available for this security flaw?

The source material does not confirm the release of a fix or updated version.