Show Doc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers

Summary: CVE-2025-0520, a 9.4-severity unrestricted file upload flaw in ShowDoc, has been actively exploited for the first time, with an attacker dropping a web shell on a U.S.-based honeypot running a vulnerable version. The bug, caused by improper file extension validation that allows arbitrary PHP uploads and remote code execution, was fixed in ShowDoc 2.8.7 in October 2020, while the current version is 3.8.1.
Key Takeaway: VulnCheck data shows more than 2,000 ShowDoc instances online, most in China, and the exploit landed on a server running a patch that has been available since October 2020 - an N-day gap of roughly five years that attackers treated as an opening.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2025-0520
Related: ⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More Cyber Risks ·
New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026
New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026