{"id":"CVE-2021-36440","details":"Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.","aliases":["GHSA-c442-3278-rhrg"],"modified":"2026-08-07T14:49:36.350360Z","published":"2021-09-08T21:15:10.657Z","references":[{"type":"REPORT","url":"https://github.com/star7th/showdoc/issues/1406"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/star7th/showdoc","events":[{"introduced":"149f8602a75bdaa5a99aaf8418aa11990f5c03f5"},{"last_affected":"149f8602a75bdaa5a99aaf8418aa11990f5c03f5"}],"database_specific":{"cpe":"cpe:2.3:a:showdoc:showdoc:2.9.5:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.9.5"},{"last_affected":"2.9.5"}],"source":"CPE_STRING"}}],"versions":["2.9.5","v2.9.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36440.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}