RomanCode MapSVG before version 8.6.12 contains an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows an attacker with low privileges to read files outside the intended directory structure by crafting malicious pathnames. The vulnerability affects confidentiality but not integrity or availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with low privileges can exploit this vulnerability remotely to access sensitive files outside the restricted directories, compromising confidentiality. There is no impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected MapSVG versions and monitor for suspicious activity related to file access. Avoid exposing the vulnerable versions to untrusted networks.