CVE-2025-0520

CriticalCVSS 9.4

Published: 29/04/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.65%

85th percentile - higher than 85% of all known CVEs

Summary

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc before 2.8.7.

Risk Assessment

An attacker can upload and execute malicious PHP code, leading to server compromise and data access.

Recommendation

Update ShowDoc to version 2.8.7 or later and verify file upload validation mechanisms.

Other vulnerabilities in ShowDoc

CVE-2026-86644Low
A vulnerability in star7th showdoc up to 3.9.1 affects unknown code in the file web_src/public/editor.md/editormd.js of the API Page Save Endpoint. Manipulation can lead to cross-site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 resolves the issue. The patch sets Mermaid 'securityLevel' to 'strict', disables 'htmlLabels', and sanitizes rendered SVG with DOMPurify.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS