CVE-2025-32682

CRITICAL

Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a t...

Affects 0 products across 3 vendors.

CVSS 3.19.9
EPSS0.6%
Percentile45th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-434: Unrestricted Upload of File with Dangerous Type

Application allows file uploads without validating type, enabling upload of executable code or web shells.

Related Attack Patterns (CAPEC)
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
via CWE-434

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows attackers to upload a web shell to the web server, potentially leading to full server compromise.

BSID: BS-2025-GLOBAL-270714-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-32682?
A critical vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows attackers to upload a web shell to the web server, potentially leading to full server compromise.
What is the CVSS score for CVE-2025-32682?
CVE-2025-32682 has CVSS 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.6%.
Is CVE-2025-32682 actively exploited?
No confirmed active exploitation of CVE-2025-32682 as of 2026-05-30.
How do I remediate CVE-2025-32682?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-32682?
CVE-2025-32682 affects Lite; Mapsvg; Vector.
Vulnerability Details
CVE IDCVE-2025-32682
BSIDBS-2025-GLOBAL-270714-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2025-04-17
Last Modified2026-04-23
ICS Relevance0%
Weakness (CWE)
Unrestricted Upload of File with Dangerous Type
SourceNVD
Official Description

Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through <= 8.6.4.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit the unrestricted file upload feature to upload a malicious file, such as a web shell, which can then be used to execute arbitrary code on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Lite — —
Mapsvg — —
Vector — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 546 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash8b7b63f7a389912440af61362f3d71beb2e04ff580cd4a80564c5cb5bc9d389ecc4df70df53dfbbf1a49bcd7cc1f524024f0a900bbd8e9693a1455f14498bf47
Related CVEs affecting Lite
CVE-2026-23693 10.0 ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elemen... CVE-2026-27044 9.9 Improper Control of Generation of Code ('Code Injection') vulnerability in To... CVE-2024-27972 9.9 Improper Control of Generation of Code ('Code Injection') vulnerability in Ja... CVE-2026-8398 9.8 A supply chain attack compromised the official installation packages of DAEMO... CVE-2020-37010 9.8 BearShare Lite 5.2.5 contains a buffer overflow vulnerability in the Advanced...
View all Lite CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →