GitHub Advisoryadvisory · Packagist
GHSA-6jmr-r7p6-f5wr ShowDoc unrestricted file upload vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2025-0520
- Ecosystem
- Packagist
- Packages
- showdoc/showdoc
- Severity
- Critical
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
- Weaknesses
- CWE-434
- Reviewed
- 2025-04-30
Affected packages
• Packagist showdoc/showdoc: < 2.8.7 → fixed in 2.8.7
Description
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc: before 2.8.7.
Related
Alias · CVE (1)
- CVE-2025-0520 An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP,… vulnerability
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-0520 advisory
- https://github.com/star7th/showdoc/pull/1059 web
- https://github.com/star7th/showdoc package
- https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585 web
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585 web
- https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce web