CVE-2026-111398: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in PT Norther Lights Production MapSVG

The vulnerability identified as CVE-2026-111398 involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw, in the MapSVG product by PT Norther Lights Production. This issue affects the mapsvg-lite-interactive-vector-maps component and allows an attacker with low privileges to potentially cause denial of service by accessing or manipulating files outside the intended directory scope. The affected versions include all releases prior to 8.16.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, no confidentiality or integrity impact, but high impact on availability.

The vulnerability can be exploited remotely by an attacker with low privileges and no user interaction to cause a denial of service condition by accessing restricted directories improperly. There is no impact on confidentiality or integrity according to the CVSS vector. The scope of the vulnerability is changed, indicating that the attacker's privileges may extend beyond the initially intended boundaries, affecting system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor PT Norther Lights Production advisories for updates. Until a fix is available, restrict access to the vulnerable component and consider implementing additional access controls to limit exposure.