CVE-2025-0520: ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

Severity: critical (CVSS 9.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-04-29 · updated 2026-10-08
Weakness: CWE-434

Description

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

Affected products

star7th/showdoc: before 2.8.7 — fixed in 2.8.7

How to fix

Upgrade to a fixed version: star7th/showdoc 2.8.7. Check the vendor advisory for mitigations.

References

https://github.com/star7th/showdoc/pull/1059
https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585
https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585
https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce

Get alerted when CVE-2025-0520 or the next vulnerability affects your stack