The vulnerability identified as CVE-2025-68562 in RomanCode MapSVG is an unrestricted file upload issue (CWE-434) that permits an attacker with low privileges to upload malicious files, such as web shells, to the web server. This can lead to complete compromise of the affected system. The vulnerability affects all versions through 8.7.3. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker to upload a web shell to the server, potentially leading to full system compromise including unauthorized access, data theft, modification, and denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions, implement strict file type validation, and monitor for suspicious upload activity as temporary mitigations.