CVE-2025-0520

ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

CVSS 9.4 CRITICALEPSS 1.0%CWE-434

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.4EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

29 Apr 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Affected products

ShowDoc · ShowDoc

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/star7th/showdoc/pull/1059 https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585 https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585 https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce