Critical
ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.
Announced Source revision 1
Original source ↗CVE-2025-0520
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-0520
ShowDoc
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "ShowDoc",
"product": "ShowDoc",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.8.7",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/showdoc/showdoc",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2025-0520
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #12623 · Revision 1
- Added to Heist Feed
- Publisher date