by Kastro
Paper/Archive/CVE-2025-0520

CVE-2025-0520

ShowDoc ShowDoc — ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

EPSS 3%public exploitCVSS 9.4
critical.is priorityof 100
55
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 85.6.856 × 2017.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

Affected

ProductAffectedFixed inSource
ShowDoc< 2.8.72.8.7CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585refgithub.com/star7th/showdoc/pull/1059writeupcnvd.org.cn/flaw/show/CNVD-2020-26585writeupvulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce