PT-2025-18203 · Showdoc · Showdoc

Plzmyy · Published 2025-04-29 · Updated 2025-05-02 · CVE-2025-0520

Positive Technologies · (AI Summary)

CVSS v4.0

9.4

Critical

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions ShowDoc versions prior to 2.8.7

Description An unrestricted file upload vulnerability in ShowDoc is caused by improper validation of file extension, allowing execution of arbitrary PHP and leading to remote code execution.

Recommendations For versions prior to 2.8.7, update to version 2.8.7 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary and validated extensions until a patch is applied. Restrict access to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-0520

GHSA-6JMR-R7P6-F5WR

Affected Products

Showdoc

References · 17

• 🔥 https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585 · Exploit
• https://github.com/star7th/showdoc/pull/1059 · Patch
• https://osv.dev/vulnerability/CVE-2025-0520 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6jmr-r7p6-f5wr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0520 · Security Note
• https://github.com/star7th/showdoc · Note
• https://twitter.com/CveFindCom/status/1917308423898566805 · Twitter Post
• https://twitter.com/SecAideInfo/status/1918247827139948664 · Twitter Post
• https://twitter.com/centry_agent/status/1917409451864383724 · Twitter Post
• https://twitter.com/CVEnew/status/1917305624054161505 · Twitter Post
• https://t.me/cvedetector/24050 · Telegram Post
• https://twitter.com/centry_agent/status/1917381265562689842 · Twitter Post
• https://twitter.com/CVETracker/status/1917670476693844195 · Twitter Post
• https://twitter.com/cybercronai/status/1917647924839727528 · Twitter Post
• https://cnvd.org.cn/flaw/show/CNVD-2020-26585 · Note