ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

ShowDoc · Unrestricted file upload · CWE-434

AffectedShowDoc

FixUpdate to 2.8.7 or newer

PublishedApr 29, 2025, 19:35 · VulnCheck

ScoredApr 29, 2025 · 9.4 · VulnCheck

Exploit code publicNov 1 · Nuclei

ExploitedNone known · CISA KEV checked 22:06 UTC

What we know

No known exploitation. CISA KEV, checked 22:06 UTC.

Public exploit code exists. Nuclei.

An attacker needs network access and an account. CVSS: network, low privileges.

A successful attack can read data and change data. CVSS impact.

A successful attack gives full control of the affected system. CISA: technical impact total.

Description

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

From VulnCheck

Affected and fixed versions

ProductAffectedFixed inShowDocbefore 2.8.72.8.7

Exploit code

Exploit-DBnone knownMetasploitnone knownNuclei1 entry

ShowDoc - Remote Code Execution
Nuclei · not verified by usOpen

References

github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585 · github.comexploit github.com/star7th/showdoc/pull/1059 · github.comissue tracking www.cnvd.org.cn/flaw/show/CNVD-2020-26585 · cnvd.org.cnthird party advisory www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce · vulncheck.comthird party advisory

Other CVEs in ShowDoc

All 1 →

8.8ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates · CVE-2026-120203Oct 31