CVE-2025-0520: ShowDoc Unrestricted File Upload Vulnerability Leading to Remote Code Execution

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

ShowDoc is an open-source documentation management tool that allows users to create, manage, and share documentation easily. It is widely used for project documentation, API documentation, and collaborative writing. However, prior to version 2.8.7, ShowDoc is vulnerable to an unrestricted file upload issue that can lead to serious security risks.

Vulnerability Detail

The vulnerability arises from improper validation of file extensions during file uploads. This flaw allows an attacker to upload arbitrary PHP files, which can then be executed on the server. The consequences of this vulnerability include remote code execution, where an attacker can run malicious code on the server, potentially compromising the entire application and its data.

composer require showdoc/showdoc:2.8.7

Workaround

As a temporary workaround, you can restrict file uploads by implementing server-side checks to validate file types and extensions. For example, you can modify your upload script to only allow specific file types, such as images or documents, and reject any PHP files. Here is a sample code snippet for validation:

if (isset($_FILES['uploaded_file'])) {
    $file_type = pathinfo($_FILES['uploaded_file']['name'], PATHINFO_EXTENSION);
    $allowed_types = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
    if (!in_array($file_type, $allowed_types)) {
        die('Invalid file type.');
    }
    // Proceed with the upload
}

Conclusion

The unrestricted file upload vulnerability in ShowDoc poses a significant risk, allowing for remote code execution. It is crucial to update to version 2.8.7 or later to mitigate this risk. Additionally, implementing server-side validation can serve as a temporary measure to protect against potential exploitation.

See every vulnerability recorded for showdoc/showdoc →

FAQ