Critical ShowDoc RCE Vulnerability Exploited in the Wild

Securityaffairs.Co

Critical ShowDoc RCE Vulnerability Exploited in the Wild

First seen 14 Apr 2026, 12:29 UTC • •76.5

Article Content

1 / 8

Browse articles

ThreatCluster •April 15, 2026 at 12:19 UTC

•CVE-2025-0520 allows remote code execution on unpatched ShowDoc servers.
•The vulnerability affects versions prior to 2.8.7, released in October 2020.
•Active exploitation has been confirmed on a U.S.-based honeypot.

A critical vulnerability in ShowDoc, a document management service, is being actively exploited. Identified as CVE-2025-0520 with a CVSS score of 9.4, the flaw allows for unrestricted file uploads and remote code execution on vulnerable servers. Attackers are targeting versions prior to 2.8.7, which was released in October 2020. Although ShowDoc has been updated to version 3.8.1, many instances remain unpatched. Exploits have been observed on a U.S.-based honeypot running a vulnerable version, indicating that the threat is not limited to China, where most instances are located. The vulnerability poses a significant risk to organizations that rely on outdated versions for internal documentation and collaboration. Cybersecurity experts recommend immediate action to mitigate the risk.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 178d ago How this analysis works

Timeline

2025-04-29

CVE-2025-0520 published

2026-04-14

Multiple articles published on ongoing attacks

Recent

Active exploitation of the vulnerability reported

More articles in this cluster (7)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Remote Code Execution
Zero-day Exploit
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2025-0520

Affected Platform (1)

ShowDoc

Relationships

CVE-2025-0520 targets ShowDoc
Remote Code Execution targets ShowDoc
Zero-day Exploit targets ShowDoc
T1190 - Exploit Public-Facing Application targets ShowDoc

Following this threat?

Track CVE-2025-0520 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…