CVE-2025-32682: WordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG Lite allows Upload a Web Shell to a Web Server. This issue affects MapSVG Lite: from n/a through 8.5.34.
Other sources
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32682?
CVE-2025-32682 is considered a high-severity vulnerability due to its potential to allow unrestricted file uploads that can compromise web servers.
How do I fix CVE-2025-32682?
To fix CVE-2025-32682, update the MapSVG Lite plugin to version 8.5.35 or later to mitigate the vulnerability.
What are the risks associated with CVE-2025-32682?
The risks associated with CVE-2025-32682 include unauthorized access to the web server through uploaded malicious files.
Which versions of MapSVG Lite are affected by CVE-2025-32682?
CVE-2025-32682 affects all versions of MapSVG Lite from n/a through 8.5.34.
Is CVE-2025-32682 a common vulnerability in web applications?
Yes, CVE-2025-32682 is common in web applications that do not properly validate file uploads, making them vulnerable to web shell attacks.