Open-source package vulnerability · Composer (PHP)
CVE-2025-0520: ShowDoc unrestricted file upload vulnerability
criticalCVSS 4.0 9.4GHSA-6jmr-r7p6-f5wr
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc: before 2.8.7.
Published Apr 29, 2025 · Updated Nov 5, 2025
Affected packages
showdoc/showdoc
- Ecosystem
- Composer (PHP)
- Affected
- < 2.8.7
- Fixed in
- 2.8.7
- Check
composer show showdoc/showdoc
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc: before 2.8.7.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-0520
- https://github.com/star7th/showdoc/pull/1059
- https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585
- https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585
- https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce
- https://github.com/advisories/GHSA-6jmr-r7p6-f5wr
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology