What is GHSA-6jmr-r7p6-f5wr?

GHSA-6jmr-r7p6-f5wr is a security advisory published by GitHub Security Advisories with Critical severity. ShowDoc unrestricted file upload vulnerability

Which CVE IDs does GHSA-6jmr-r7p6-f5wr cover?

GHSA-6jmr-r7p6-f5wr covers the following CVE IDs: CVE-2025-0520. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-6jmr-r7p6-f5wr?

GHSA-6jmr-r7p6-f5wr affects 1 product, including: composer/showdoc/showdoc:\u003c 2.8.7.

GHSA-6jmr-r7p6-f5wrCritical

ShowDoc unrestricted file upload vulnerability

Vendor

GitHub Security Advisories

Published

April 29, 2025

Last Modified

November 5, 2025

🔗 CVE IDs covered (1)

CVE-2025-0520 →

📋 Description

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc: before 2.8.7.

🎯 Affected products1

composer/showdoc/showdoc:< 2.8.7

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-0520
https://github.com/star7th/showdoc/pull/1059
https://github.com/vulhub/vulhub/tree/master/showdoc/CNVD-2020-26585
https://www.cnvd.org.cn/flaw/show/CNVD-2020-26585
https://www.vulncheck.com/advisories/showdoc-unauthenticated-file-upload-rce
https://github.com/advisories/GHSA-6jmr-r7p6-f5wr