Unrestricted File Upload in ShowDoc v2.9.5

CRITICAL 9.8CVE-2021-36440 · GHSA-c442-3278-rhrg · Published 08/09/2021 · updated 17/06/2026

In short

CVE-2021-36440 is a CRITICAL (CVSS 9.8) vulnerability affecting showdoc/showdoc, showdoc (showdoc).
Chance of exploitation in the next 30 days (EPSS): 4.8%, higher than 91.9% of all vulnerabilities.
Fix: update to 2.9.6 or later.

Package	Affected versions	Patched versions
showdoc/showdoc Packagist	`< 2.9.6`	`2.9.6`
showdoc showdoc	`= 2.9.5`	No fix yet

Description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

NVD description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

References

nvd.nist.gov/vuln/detail/CVE-2021-36440 · ADVISORY
star7th/showdoc · WEB
star7th/showdoc commit 49b992d · WEB
star7th/showdoc · PACKAGE

More vulnerabilities in showdoc/showdoc

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

showdoc/showdoc

Packagist

< 2.9.6

2.9.6

showdoc

= 2.9.5

No fix yet

Description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

NVD description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

More vulnerabilities in showdoc/showdoc

See all →