GHSA-6jmr-r7p6-f5wr

ShowDoc unrestricted file upload vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-0520

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	showdoc/showdoc	< 2.8.7	2.8.7

Details

As written in the advisory (Markdown source, shown as plain text).

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc: before 2.8.7.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-0520 advisory
https://github.com/star7th/showdoc/pull/1059 web
https://github.com/star7th/showdoc package
https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585 web
https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585 web
https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce web