{"id":45381,"date":"2026-04-14T16:17:35","date_gmt":"2026-04-14T08:17:35","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/14\/showdoc-rce-flaw-cve-2025-0520-actively-exploited-on-unpatched-servers\/"},"modified":"2026-04-14T16:17:35","modified_gmt":"2026-04-14T08:17:35","slug":"showdoc-rce-flaw-cve-2025-0520-actively-exploited-on-unpatched-servers","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/14\/showdoc-rce-flaw-cve-2025-0520-actively-exploited-on-unpatched-servers\/","title":{"rendered":"ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers"},"content":{"rendered":"
\"ShowDoc<\/a><\/div>\n

A critical security vulnerability impacting ShowDoc<\/a>, a document management and collaboration service popular in China, has come under active exploitation in the wild.<\/p>\n

The vulnerability in question is CVE-2025-0520<\/a><\/strong> (aka CNVD-2020-26585), which carries a CVSS score of 9.4 out of 10.0.<\/p>\n

It relates to a case of unrestricted file upload that stems from improper validation of file extension, allowing an attacker to upload arbitrary PHP files and achieve remote code execution.<\/p>\n

“[In] ShowDoc version before 2.8.7, an unrestricted and unauthenticated file upload issue is found and [an] attacker is able to upload a web shell and execute arbitrary code on server,” according to an advisory released<\/a> by Vulhub. <\/p>\n

The vulnerability was addressed in ShowDoc version 2.8.7<\/a>, which was shipped in October 2020. The current version of the software is 3.8.1<\/a>.<\/p>\n

According to new details<\/a> shared by Caitlin Condon, vice president of security research at VulnCheck, CVE-2025-0520 has come under active exploitation for the first time.<\/p>\n

The observed exploit involves leveraging the flaw to drop a web shell on a U.S.-based honeypot running a vulnerable version of ShowDoc. Data shared by the company shows that there are more than 2,000 instances of ShowDoc online, most of which are located in China.<\/p>\n

The development is the latest example of how threat actors are increasingly exploiting N-day security vulnerabilities, regardless of their install base. Users who are running ShowDoc are advised to update to the latest version for optimal protection.<\/p>\n

<\/div>\n
Found this article interesting? Follow us on Google News<\/a>, Twitter<\/a> and LinkedIn<\/a> to read more exclusive content we post.<\/div>\n","protected":false},"excerpt":{"rendered":"

A critical security vulnerability impacting ShowDoc, a document management and collaboration service popular in China, has come under active exploitation in the wild.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-45381","post","type-post","status-publish","format-standard","hentry","category-thehackernews"],"_links":{"self":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts\/45381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/comments?post=45381"}],"version-history":[{"count":0,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/posts\/45381\/revisions"}],"wp:attachment":[{"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/media?parent=45381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/categories?post=45381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/wp-json\/wp\/v2\/tags?post=45381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}