The vulnerability CVE-2025-47559 affects RomanCode MapSVG before version 8.7.4. It permits an attacker with low privileges to upload files of dangerous types, such as web shells, without restriction. This unrestricted file upload vulnerability can be exploited remotely over the network without user interaction, resulting in full system compromise. The CVSS v3.1 base score is 9.9, reflecting its critical severity with network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server hosting MapSVG, leading to full compromise of the affected system's confidentiality, integrity, and availability. This can result in unauthorized access, data theft, data modification, service disruption, or further network penetration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official vendor advisories are provided, users should monitor RomanCode's official channels for updates. Until a fix is available, restrict access to the MapSVG upload functionality to trusted users only and consider disabling file upload features if possible.