Unrestricted File Upload in ShowDoc v2.9.5

KRITISCH 9.8CVE-2021-36440 · GHSA-c442-3278-rhrg · Published 08/09/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-36440 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in showdoc/showdoc, showdoc (showdoc).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 4.8%, höher als bei 91.9% aller Schwachstellen.
Abhilfe: auf 2.9.6 oder neuer aktualisieren.

Package	Affected versions	Patched versions
showdoc/showdoc Packagist	`< 2.9.6`	`2.9.6`
showdoc showdoc	`= 2.9.5`	No fix yet

Description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

NVD description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

References

nvd.nist.gov/vuln/detail/CVE-2021-36440 · ADVISORY
star7th/showdoc · WEB
star7th/showdoc commit 49b992d · WEB
star7th/showdoc · PACKAGE

Weitere Schwachstellen in showdoc/showdoc

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

showdoc/showdoc

Packagist

< 2.9.6

2.9.6

showdoc

= 2.9.5

No fix yet

Description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

NVD description

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.

Weitere Schwachstellen in showdoc/showdoc

Alle anzeigen →