{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mapsvg--8.16.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pt_norther_lights_production:mapsvg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-111398"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MapSVG (\u003c= 8.16.1)"],"_cs_severities":["critical"],"_cs_tags":["web-vulnerability","path-traversal","cve","web-application","wordpress","vulnerability","rce"],"_cs_type":"advisory","_cs_vendors":["PT Norther Lights Production"],"content_html":"\u003cp\u003eCVE-2026-111398 describes an improper limitation of a pathname to a restricted directory, commonly referred to as a path traversal vulnerability, affecting the MapSVG plugin (specifically the mapsvg-lite-interactive-vector-maps component) developed by PT Norther Lights Production. This vulnerability impacts all versions of the plugin up to and including 8.16.1. The flaw allows remote, unauthenticated attackers to manipulate file path parameters in HTTP requests, enabling access to files outside of the intended web root directory. If successful, this can lead to the exposure of sensitive configuration files, source code, or other system information, significantly increasing the risk of further exploitation or complete server compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a high risk to web servers running vulnerable versions of the MapSVG plugin, as it facilitates unauthorized information disclosure. Depending on the server configuration and file permissions, an attacker could extract credentials, environment variables, or database connection strings, potentially leading to escalation of privilege and full system takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all web application assets to identify instances of the MapSVG plugin.\u003c/li\u003e\n\u003cli\u003eUpgrade the MapSVG plugin to the latest version, ensuring it is beyond the affected range (8.16.1).\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not feasible, implement a Web Application Firewall (WAF) rule to block incoming HTTP requests containing directory traversal sequences (e.g., ../, ..).\u003c/li\u003e\n\u003cli\u003ePerform a security review of web server file permissions to ensure the web service account has the principle of least privilege, minimizing the impact of potential file disclosure.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T12:03:25Z","date_published":"2026-10-19T12:03:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-path-traversal-mapsvg/","summary":"A path traversal vulnerability in the MapSVG plugin, tracked as CVE-2026-111398, allows unauthenticated attackers to read arbitrary files from the hosting server.","title":"Path Traversal Vulnerability in MapSVG Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-path-traversal-mapsvg/"}],"language":"en","title":"CraftedSignal Threat Feed - MapSVG (\u003c= 8.16.1)","version":"https://jsonfeed.org/version/1.1"}