{
  "claim": {
    "argus_claim_ref": null,
    "attacker_control": null,
    "claimed_surface": "library_api",
    "expected_impact": "code_execution",
    "finding_id": null,
    "id": null,
    "required_entrypoint_detail": null,
    "required_entrypoint_kind": "function_call",
    "submission_reason": "ticket_derived",
    "trigger_class": null,
    "upstream_verdicts": null
  },
  "latest_description": "ShowDoc versions before 2.8.7 contain an unrestricted file upload vulnerability. Due to deprecated ThinkPHP 3.1 syntax ($upload->allowExts instead of $upload->exts), attackers bypass extension checks using angle bracket tricks (e.g., test.<>php) to upload PHP webshells. The endpoint /index.php?s=/home/page/uploadImg is accessible without authentication.\n\n**Root Cause:** server/Application/Home/Controller/PageController.class.php in uploadImg() uses deprecated ThinkPHP 3.1 $upload->allowExts which is ignored in ThinkPHP 3.2+. Extension whitelist not enforced. Attackers can upload PHP files stored in ./Public/Uploads/.\n\n**Reproduction Strategy:**\n1. Start vulnerable ShowDoc 2.8.2 environment (e.g., via Vulhub at vulhub/showdoc/CNVD-2020-26585)\n2. POST to /index.php?s=/home/page/uploadImg with multipart/form-data containing malicious PHP file named 'test.<>php'\n3. Uploaded PHP file stored at /Public/Uploads/ can be accessed directly for RCE\n\n**Fix:**\n- Commit fb77dd4: Changed $upload->allowExts to $upload->exts (correct ThinkPHP 3.2+ syntax)\n- Commit e1cd02a: Defense in depth - disabled uploadImg endpoint by returning false\n\n**References:**\n- GHSA-6jmr-r7p6-f5wr\n- https://github.com/star7th/showdoc/commit/fb77dd4db88dc23f5e570fc95919ee882aca520a\n- https://github.com/star7th/showdoc/commit/e1cd02a3f98bb227c0599e7fa6b803ab1097597f",
  "product": "showdoc/showdoc",
  "severity": "critical",
  "status": "open",
  "summary": "ShowDoc Unauthenticated File Upload RCE via deprecated ThinkPHP syntax",
  "ticket_id": "CVE-2025-0520"
}