Skip to content

CVE-2025-0520: Verified Repro With Script Download

CVE-2025-0520: ShowDoc Unauthenticated File Upload RCE via deprecated ThinkPHP syntax

Download script Open in Codespaces

CVE-2025-0520 is verified against showdoc/showdoc · github. Affected versions: ShowDoc versions before 2.8.7 (commonly referenced as <=2.8.6); Vulhub lab uses 2.8.2. Vulnerability class: RCE. This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00132.

REPRO-2026-00132 showdoc/showdoc · github RCE Apr 14, 2026 CVE entry ↗ .txt
Severity
CRITICAL
CVSS
9.4
Reproduced in
139m 41s
Tool calls
526
01 · Overview

What Is CVE-2025-0520?

CVE-2025-0520 is a critical unauthenticated file-upload leading to remote code execution in ShowDoc. An attacker can upload a PHP webshell by bypassing the extension check. Pruva reproduced it (reproduction REPRO-2026-00132).

02 · Severity & CVSS

CVE-2025-0520 Severity & CVSS Score

CVE-2025-0520 is rated critical severity, with a CVSS base score of 9.4 out of 10.

CRITICAL threat level
9.4 / 10 CVSS base
Weakness CWE-434 — Unrestricted Upload of File with Dangerous Type

Critical — the most severe class — typically remotely exploitable with severe impact. Treat as an emergency.

03 · Affected Versions

Affected showdoc/showdoc Versions

showdoc/showdoc · github versions ShowDoc versions before 2.8.7 (commonly referenced as <=2.8.6); Vulhub lab uses 2.8.2 are affected.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2025-0520

$ pruva-verify REPRO-2026-00132
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00132/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2025-0520

Reproduced by Pruva's autonomous agents — 526 tool calls over 2h 20m. Full root-cause analysis and the complete transcript are below.

How the agent worked 639 events · 526 tool calls · 2h 20m
2h 20mDuration
526Tool calls
102Reasoning steps
639Events
5Dead-ends
Agent activity over 2h 20m
Support
11
Hypothesis
1
Repro
274
Judge
46
Variant
179
Coding
122
0:00139:41

Root Cause and Exploit Chain for CVE-2025-0520

Summary

ShowDoc v2.8.2 is vulnerable to unauthenticated file upload leading to code execution. The real endpoint POST /index.php?s=/home/page/uploadImg accepts a multipart file named test.<>php, stores it under Public/Uploads, and the uploaded PHP is executable. The bug is caused by deprecated ThinkPHP syntax ($upload->allowExts) being ignored, so extension allowlisting is not enforced in the effective upload path.

Impact

  • Package/component affected: showdoc/showdoc, PageController::uploadImg() and ThinkPHP upload handling (ThinkPHP Upload->upload())
  • Affected versions: ShowDoc before 2.8.7 (runtime validated on v2.8.2)
  • Risk level: Critical
  • Consequences:
    • Unauthenticated attacker can upload executable PHP
    • Uploaded file is reachable from web path (/Public/Uploads/...)
    • Remote code execution in application context

Root Cause

In vulnerable code, uploadImg() configures ThinkPHP upload with:

  • $upload->allowExts = array('jpg','gif','png','jpeg');
  • then $info = $upload->upload();

On ThinkPHP 3.2+, allowExts is deprecated/ignored and the active key is exts. Because of this mismatch, intended extension restrictions are ineffective in the vulnerable path. A crafted filename (test.<>php) bypasses the simple .php substring check and results in a saved .php payload.

Fix commits:

  • fb77dd4db88dc23f5e570fc95919ee882aca520a: replaces allowExts with exts (upload blocked)
  • e1cd02a3f98bb227c0599e7fa6b803ab1097597f: adds early return false in uploadImg() (endpoint disabled)

Reproduction Steps

  1. Run repro/reproduction_steps.sh.
  2. The script:
    • clones ShowDoc and checks out three revisions: vulnerable v2.8.2, fixed fb77dd4, fixed e1cd02a
    • builds Docker runtime images (php:7.4-apache) for each revision
    • initializes each instance via install/non_interactive.php
    • sends real multipart POST to /index.php?s=/home/page/uploadImg with filename test.<>php
    • for vulnerable revision, requests the uploaded PHP and verifies execution marker
    • for fixed revisions, verifies upload rejection/disable behavior and absence of uploaded PHP
  3. Expected evidence:
    • vulnerable upload response contains success JSON + uploaded .php URL
    • vulnerable execution response contains RCE_OK_1e08f13e8e4695e97fef6d9de3665be4
    • fb77 shows 上传文件后缀不允许 and no uploaded PHP
    • e1cd returns empty response body and no uploaded PHP

Evidence

  • Execution logs:
    • logs/reproduction_run8.log
    • logs/reproduction_run9.log
  • Vulnerable artifacts:
    • repro/runtime_artifacts/http/vuln/upload_response.txt
    • repro/runtime_artifacts/http/vuln/uploaded_php_files.txt
    • repro/runtime_artifacts/http/vuln/webshell_exec_response.txt
    • repro/runtime_artifacts/http/vuln/container.log
    • repro/runtime_artifacts/http/vuln/controller_lines.txt
    • repro/runtime_artifacts/http/vuln/controller_upload_flow.txt
  • Fixed artifacts:
    • repro/runtime_artifacts/http/fb77/upload_response.txt
    • repro/runtime_artifacts/http/fb77/uploaded_php_files.txt
    • repro/runtime_artifacts/http/fb77/container.log
    • repro/runtime_artifacts/http/e1cd/upload_response.txt
    • repro/runtime_artifacts/http/e1cd/uploaded_php_files.txt
    • repro/runtime_artifacts/http/e1cd/container.log
  • Revision evidence:
    • repro/runtime_artifacts/http/vuln/revision.txt
    • repro/runtime_artifacts/http/fb77/revision.txt
    • repro/runtime_artifacts/http/e1cd/revision.txt
  • Summary artifact:
    • repro/runtime_artifacts/http/summary.txt

Recommendations / Next Steps

  • Upgrade to a fixed release (>= 2.8.7) or include both fixes (fb77dd4 and e1cd02a).
  • Keep upload endpoint authenticated or disabled if not required.
  • Enforce strict extension/MIME checks with current framework API (exts) and add server-level execution restrictions in upload directories.
  • Add regression tests for tricky filenames like test.<>php and other extension obfuscation inputs.

Additional Notes

  • Idempotency: confirmed. repro/reproduction_steps.sh was run twice consecutively (reproduction_run8.log, reproduction_run9.log) with successful reproduction and consistent vulnerable-vs-fixed behavior.
  • Limitation: requires Docker availability in the execution environment.

CVE-2025-0520 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:0010:14
0:00
session startedgpt-4o · CVE-2025-0520 · 6b0c23ce
0:38
web search
0:42
1:00
1:04
1:15
web search
1:20
1:38
1:41
2:26
extract_facts
no facts extracted
2:28
2:30
2:30
supportrepro
8:33
✗ error

Unknown error

8:35
8:35
8:35
8:38
8:38
8:44
8:46
web search
8:52
8:54
8:58
9:04
$git clone --depth 1 https://github.com/vulhub/vulhub.git /tmp/vulhub 2>&1 | tail -5
6.5s✓
Cloning into '/tmp/vulhub'...
9:08
9:08
9:09
9:14
9:14
$docker ps 2>&1
0.2s✓
{"cwd":"/data/pruva/runs/6b0c23ce-21d5-489c-b632-93979a285c2b","duration_ms":185,"exit_code":0,"stderr":"","stdout":"CONTAINER ID   IMAGE                                  COMMAND                  CREATED         STATUS                   PORTS                                         NAMES\na0b5323ed02e   pruva-rs-pruva-worker-sandbox:latest   \"pruva-worker --back…\"   7 minutes ago   Up 7 minutes (healthy)                                                 pruva-rs-pruva-worker-kimi-k2p5-1\n30ca29941dbc   pruva-rs-pruva-worker-sandbox:latest   \"pruva-worker --back…\"   7 minutes ago   Up 7 minutes (healthy)                                                 pruva-rs-pruva-worker-glm-5p1-1\nc646475c0b52   pruva-rs-pruva-worker-sandbox:latest   \"pruva-worker --back…\"   7 minutes ago   Up 7 minutes (healthy)                                                 pruva-rs-pruva-worker-qwen3p6-plus-1\na9530c951be2   pruva-rs-pruva-worker-sandbox:latest   \"pruva-worker --back…\"   7 minutes ago   Up 7 minutes (healthy)                                                 pruva-rs-pruva-worker-minimax-m2p7-1\nd7cacc05a249   pruva-rs-pruva-api                     \"/app/pruva-api --po…\"   21 hours ago … [truncated]
9:53
9:53
#!/bin/bash
set -euo pipefail

# Portable paths - works from any directory
ROOT="${PRUVA_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
LOGS="$ROOT/logs"
mkdir -p "$LOGS"
REPRO="$ROOT/repro"
mkdir -p "$REPRO"

cd "$ROOT"

echo "========================================="
echo "CVE-2025-0520 ShowDoc File Upload RCE Reproduction"
echo "========================================="

# Check Docker is available
if ! command -v docker &> /dev/null; then
    echo "ERROR: Docker is not available"
    exit 1
10:09
10:12
$git clone --depth 1 https://github.com/star7th/showdoc.git /tmp/showdoc 2>&1 | tail -3
2.0s✓
Cloning into '/tmp/showdoc'...
10:13
10:13
10:14
10:14

Artifacts and Evidence for CVE-2025-0520

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available
08 · How to Fix

How to Fix CVE-2025-0520

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2025-0520 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2025-0520

Is CVE-2025-0520 exploitable without authentication?

Yes. The uploadImg endpoint accepts the crafted file without authentication, so a remote attacker can drop and execute a PHP webshell on the server.

Which versions of ShowDoc are affected by CVE-2025-0520?

ShowDoc versions before 2.8.7 (commonly referenced as <= 2.8.6) are affected; the reproduction uses 2.8.2. Upgrade to 2.8.7 or later.

How can I reproduce CVE-2025-0520?

Download the verified script from this page and run it in an isolated environment against ShowDoc < 2.8.7. It POSTs a file named like test.<>php to /index.php?s=/home/page/uploadImg and shows the stored PHP executing from Public/Uploads.
11 · References

References for CVE-2025-0520

Authoritative sources for CVE-2025-0520 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.