Why is MapSVG 8.16.1 at risk of web shells due to unrestricted file upload flaw CVE-2026-111406?

The MapSVG plugin contains a critical security flaw that permits attackers to upload web shells to vulnerable servers. This unrestricted file upload vulnerability, tracked as CVE-2026-111406, affects all versions of the software up to 8.16.1. The defect allows malicious actors to upload dangerous file types, placing executable code directly onto the web server environment.

What is the technical impact of this flaw?

The vulnerability is classified as CWE-434, which denotes the unrestricted upload of files with dangerous types. According to the National Vulnerability Database record, this weakness allows an attacker to upload a web shell. A web shell is a script that provides remote access to the server. The issue exists in PT Norther Lights Production MapSVG maps.

Which versions of MapSVG are at risk?

The National Vulnerability Database states that the issue affects MapSVG from an unknown starting version through 8.16.1. Any installation running version 8.16.1 or earlier is considered vulnerable. Users running these specific builds should assume their environment is exposed to this upload vector until a patched version is confirmed and deployed.

How severe is this vulnerability rated?

The flaw has been assigned a CVSS score of 9.9, which is rated as critical. This high score reflects the severity of the unrestricted file upload vulnerability. The critical rating underscores the immediate risk posed to any web server hosting the affected versions of the MapSVG plugin.

Is there a fix available yet?

No fix has been confirmed yet. The source material does not mention a patched version or a security update released by the vendor. Until PT Norther Lights Production provides a secure update, administrators must rely on compensating controls to mitigate the risk of unauthorized file uploads.

What analysts watch for

Teams usually monitor web server directories for unexpected file creations, particularly in upload folders. Analysts examine file extensions and content for signs of web shells, looking for scripts that do not belong to the application. They also review access logs for unusual POST requests that may indicate an attempt to upload malicious code. Checking for new admin accounts or modified configuration files helps detect persistence mechanisms established after an initial breach.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: MapSVG

• Restrict file upload permissions on the server to prevent execution of uploaded scripts.
• Monitor web server logs for unusual upload activity or requests to sensitive directories.
• Verify that all installed plugins are up to date once the vendor provides an update.
• Implement web application firewalls to block known malicious file upload patterns.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for the MapSVG web shell vulnerability?

The vulnerability is identified as CVE-2026-111406.

What is the CVSS score for this MapSVG flaw?

The flaw has a CVSS score of 9.9.

Which versions of MapSVG are affected?

All versions up to and including 8.16.1 are affected.