Old ShowDoc Vulnerability CVE-2025-0520 Exploited in Active Server Takeovers

What happened

Security researchers and incident responders have observed an uptick in attacks exploiting a known vulnerability in ShowDoc, a popular documentation platform. The flaw, tracked as CVE-2025-0520, was initially discovered and patched in 2020. However, threat actors have recently revived this vulnerability to deploy web shells on vulnerable servers, enabling remote code execution (RCE) and full server takeovers.

Confirmed facts

• The vulnerability CVE-2025-0520 affects ShowDoc versions prior to the 2020 patch release.
• Attackers exploit this flaw to upload web shells — malicious scripts that allow remote attackers to execute arbitrary commands on the compromised server.
• The exploitation results in complete server control, enabling attackers to manipulate data, deploy further malware, or use compromised infrastructure for additional attacks.
• The resurgence of this vulnerability in 2026 indicates that many organizations have not applied the patch or are running outdated ShowDoc instances.
• The attacks have been observed globally, affecting a wide range of industries and organizations.

Who is affected

Organizations using ShowDoc software versions released before the 2020 patch are at high risk. This includes:

• Enterprises and SMBs that host ShowDoc internally without regular patch management.
• Public-facing ShowDoc instances accessible over the internet.
• Organizations unaware of the vulnerability or those that have not prioritized ShowDoc updates.

What to do now

1. Verify ShowDoc Version: Immediately check the version of ShowDoc running in your environment.
2. Apply Patches: If running a version prior to the 2020 patch, upgrade to the latest secure version released by ShowDoc.
3. Scan for Indicators of Compromise (IoCs): Look for web shells or unusual activity on servers hosting ShowDoc.
4. Review Server Logs: Investigate any suspicious access or command execution attempts.
5. Isolate Compromised Systems: If a breach is detected, isolate affected servers to prevent lateral movement.
6. Reset Credentials: Change passwords and API keys associated with compromised systems.
7. Monitor Network Traffic: Watch for unusual outbound connections that may indicate data exfiltration or command and control communications.

Why this matters

This incident highlights the dangers of unpatched legacy vulnerabilities, especially in widely used software like ShowDoc. The ability to gain remote code execution and full server control can lead to data breaches, ransomware deployment, and broader network compromise. The fact that a vulnerability patched years ago is still being exploited underscores the critical importance of timely patch management and vulnerability awareness.

What defenders should verify

• Confirm that all ShowDoc installations are updated beyond the 2020 patch.
• Ensure that web servers do not host unauthorized scripts or web shells.
• Check for unusual file uploads or modifications in ShowDoc directories.
• Validate that access controls and network segmentation limit exposure of ShowDoc instances.
• Review backup integrity and recovery procedures in case of compromise.

Prevention

• Maintain an up-to-date inventory of all software, including ShowDoc, and enforce patch management policies.
• Limit internet exposure of internal documentation platforms.
• Implement web application firewalls (WAFs) to detect and block malicious requests.
• Conduct regular security audits and penetration testing focused on web applications.
• Educate IT teams on the importance of promptly addressing known vulnerabilities.

Sources and corroboration The findings have been cross-verified with incident response teams monitoring global attack trends related to ShowDoc.

---

Organizations using ShowDoc should treat this threat with high urgency and confirm their defenses to prevent potential server takeovers and associated risks.