CVE-2025-0520

ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

Affected

ShowDoc

CVSS v4.0 VULNCHECK

9.4 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v4.0 GitHub

9.4 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

EPSS

2.65% chance of exploitation in the next 30 days, 85th percentile

Nuclei

critical · CWE-434

Published

2025-04-29

Updated

2026-10-08

Proof-of-concept exploits (1)

• vulhub/vulhub/tree/master/showdoc/CNVD-2020-2658521363★ · 2026-10-14

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0520.yaml

Security advisories

• advisories/GHSA-6jmr-r7p6-f5wr

References

• CVE Record
• NVD entry

Related

• CVE-2017-1000353
• CVE-2024-7314