CVE-2025-0520

ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

CVSS 9.4 CRITICALEPSS 1.0%CWE-434

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.4EPSS 1.0%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

29 abr 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Produtos afetados

ShowDoc · ShowDoc

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/star7th/showdoc/pull/1059 https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585 https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585 https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce