CVE-2021-36440: 
PHP vulnerability analysis and mitigation

A file upload vulnerability was discovered in ShowDoc v2.9.5 that allows remote download of compressed files, where files in the compressed package can be released to the web directory when decompressed. The vulnerability was identified in June 2021 and assigned CVE-2021-36440. The affected component is the AdminUpdateController.class.php file in the server/Application/Api/Controller/ directory (GitHub Issue).

The vulnerability exists in the download function of AdminUpdateController.class.php. The function accepts a fileurl parameter that allows remote download of compressed files without proper validation. When the compressed file is decompressed, its contents are extracted to the web directory. The vulnerability can be exploited by sending a POST request to /server/index.php?s=/api/adminUpdate/download with parameters newversion and file_url pointing to a malicious zip file (GitHub Issue).

The vulnerability allows attackers to upload malicious files to the web directory through a compressed file, potentially leading to remote code execution or unauthorized access to the system (GitHub Issue).

The vulnerability was discovered in ShowDoc v2.9.5. Users should upgrade to a patched version if available. No specific workarounds were provided in the available sources (GitHub Issue).