CVE-2025-47559: WordPress MapSVG plugin < 8.7.4 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG allows Upload a Web Shell to a Web Server. This issue affects MapSVG: from n/a through 8.5.32.
Other sources
Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through < 8.7.4.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47559?
CVE-2025-47559 has been classified as a high-severity vulnerability due to the potential for unrestricted file uploads leading to web shell deployment.
How do I fix CVE-2025-47559?
To fix CVE-2025-47559, update the RomanCode MapSVG or WordPress MapSVG plugin to versions beyond 8.5.32 that address this vulnerability.
What types of files can be uploaded due to CVE-2025-47559?
CVE-2025-47559 allows the upload of files with dangerous types, potentially including scripts that can execute on the server.
Which versions of MapSVG are affected by CVE-2025-47559?
CVE-2025-47559 affects all versions of RomanCode MapSVG up to and including 8.5.32.
Can CVE-2025-47559 lead to a complete server compromise?
Yes, exploitation of CVE-2025-47559 can allow an attacker to upload a web shell, potentially leading to full control of the server.