critical9.4
CVE-2025-0520
ShowDoc unrestricted file upload vulnerability
Impact
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc: before 2.8.7.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | showdoc/showdoc | < 2.8.7 | 2.8.7 |
Affected products
| Product | Affected versions |
|---|---|
| ShowDoc | before 2.8.7. |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/star7th/showdoc/pull/1059
- https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585
- https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce
- https://github.com/advisories/GHSA-6jmr-r7p6-f5wr
- https://nvd.nist.gov/vuln/detail/CVE-2025-0520