CVE-2025-0520
CVE-2025-0520 · ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.
CVSS 9.4 · Critical · EPSS 2.6% · Public exploit · Fix available
- Published
- Updated
Stack: php
Affected products and versions
showdoc
- Versions
- ≥ 0, < 2.8.7: Affected (semver)
Update to 2.8.7
showdoc/showdoc Packagist
- Versions
- v1.0.0
- v1.0.1
- v1.0.2
- v1.0.3
- v1.0.4
- v1.0.5
- v1.1.0
- v1.1.1
- v1.1.3
- v1.1.4
- v1.1.5
- v1.2.0
- v1.2.1
- v1.2.2
- v1.2.3
- v1.2.4
- v1.2.5
- v1.2.6
- v1.3.0
- v1.3.1
- v1.3.3
- v1.3.4
- v1.3.5
- v1.3.6
- v1.3.7
- v1.3.8
- v1.4.0
- v1.4.1
- v1.4.2
- v1.4.3
- v1.4.4
- v1.4.5
- v1.4.6
- v1.4.7
- v1.5.0
- v1.5.1
- v1.5.2
- v1.5.3
- v1.6.0
- v1.6.1
- v1.6.2
- v1.7.0
- v1.7.1
- v1.7.2
- v1.8.0
- v1.8.1
- v1.8.2
- v1.8.3
- v1.8.4
- v1.8.5
- v1.8.6
- v2.0
- v2.0.1
- v2.0.10
- v2.0.2
- v2.0.3
- v2.0.4
- v2.0.5
- v2.0.6
- v2.0.7
- v2.0.8
- v2.0.9
- v2.1.0
- v2.1.1
- v2.1.2
- v2.1.3
- v2.1.4
- v2.1.5
- v2.2.0
- v2.2.1
- v2.3.0
- v2.3.1
- v2.3.3
- v2.4.0
- v2.4.1
- v2.4.10
- v2.4.11
- v2.4.12
- v2.4.13
- v2.4.15
- v2.4.16
- v2.4.17
- v2.4.2
- v2.4.3
- v2.4.5
- v2.4.6
- v2.4.7
- v2.4.8
- v2.4.9
- v2.5.1
- v2.5.2
- v2.5.3
- v2.5.5
- v2.6.1
- v2.6.2
- v2.6.3
- v2.6.5
- v2.6.6
- v2.6.7
- v2.7.0
- v2.7.1
- v2.8.0
- v2.8.1
- v2.8.2
- v2.8.3
- v2.8.5
- v2.8.6
- Affected ranges
- ECOSYSTEM: < 2.8.7
Update to 2.8.7