cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

ShowDoc CVE-2025-0520 Flaw Actively Exploited to Deploy Web Shells

· Original article ↗

Summary

VulnCheck reports active exploitation of ShowDoc CVE-2025-0520, an unauthenticated file-upload flaw that enables PHP web-shell deployment and remote code execution. A web shell was observed on a U.S. honeypot; versions before 2.8.7 are affected.

Key points

  • CVE-2025-0520 (CNVD-2020-26585) is an unrestricted file-upload flaw in ShowDoc, rated CVSS 9.4.
  • Improper file-extension validation allows unauthenticated attackers to upload PHP files and execute code on vulnerable servers.
  • VulnCheck reports active exploitation; a web shell was observed on a U.S.-based honeypot running a vulnerable ShowDoc version.
  • ShowDoc versions before 2.8.7 are affected; the vulnerability was fixed in version 2.8.7, released in October 2020.
  • The article reports more than 2,000 ShowDoc instances online and advises administrators to update to the latest release.

Article Details

Vulnerability Types
  • Unrestricted file upload due to improper file-extension validation
Severity
Critical (CVSS 9.4)
Affected Versions
  • ShowDoc versions before 2.8.7
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers are actively exploiting CVE-2025-0520 against vulnerable ShowDoc instances to achieve remote code execution.T1505.003 · Web ShellThe observed exploit dropped a web shell on a U.S.-based honeypot running a vulnerable ShowDoc version.

CVE

CVE-2025-0520ShowDoc · ShowDocA critical unrestricted file upload vulnerability in ShowDoc (CVE-2025-0520 / CNVD-2020-26585) is being actively exploited to drop web shells and achieve remote code execution.

People

Caitlin CondonVulnCheck vice president of security research who shared details of active exploitation of CVE-2025-0520.

Products

ShowDocA critical unrestricted file upload vulnerability in ShowDoc (CVE-2025-0520 / CNVD-2020-26585) is being actively exploited to drop web shells and achieve remote code execution.

Countries

ChinaThere are over 2,000 ShowDoc instances online (mostly in China); administrators are urged to update to the latest version immediately.United StatesVulnCheck and Vulhub reported active exploitation, including web shells found on a U.S.-based honeypot.