CVE-2025-0520CWE-434unrestricted-file-upload

CVE-2025-0520

published April 30, 2025

CVSS
9.4
EPSS
3%
Percentile
85.5
In the wild
Unconfirmed
What it is

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

The record
Technical detail
CVSS
9.4 · NONE
CVSS v4.0
Not supplied
EPSS
0.02647 · 85.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-04-30T00:15Z
References (4)
https://github.com/star7th/showdoc/pull/1059 · [email protected]https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585 · [email protected]https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585 · [email protected]https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce · [email protected]
EPSS history
Timeline
  • 29 APR 19:35Z
    ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution
    cvelistv5