The vulnerability CVE-2025-32682 affects RomanCode MapSVG versions up to 8.6.4 and allows an attacker with low privileges to upload files without proper restrictions on file types. This unrestricted file upload can be exploited to upload a web shell, potentially leading to full system compromise. The CVSS 3.1 score of 9.9 reflects the critical nature of this vulnerability, with network attack vector, low attack complexity, no user interaction required, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server via a web shell, resulting in full compromise of the affected system's confidentiality, integrity, and availability. This could lead to unauthorized access, data theft, data manipulation, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict file upload permissions and monitor for suspicious file uploads. Avoid exposing the affected plugin to untrusted users with upload capabilities.