CVE-2026-120203
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
Risk Assessment
An authenticated user can execute arbitrary commands on the server, including as root in the official Docker image. This leads to full host compromise and access to documentation and data.
Recommendation
Upgrade ShowDoc to version 3.9.6 or later. Restrict user account privileges and avoid running the container as root.
Other vulnerabilities in ShowDoc
See all- CVE-2025-0520Critical
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc before 2.8.7.
- CVE-2026-119661Medium
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. An authenticated attacker can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
- CVE-2026-86644Low
A vulnerability in star7th showdoc up to 3.9.1 affects unknown code in the file web_src/public/editor.md/editormd.js of the API Page Save Endpoint. Manipulation can lead to cross-site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 resolves the issue. The patch sets Mermaid 'securityLevel' to 'strict', disables 'htmlLabels', and sanitizes rendered SVG with DOMPurify.
- CVE-2026-6982Medium
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0 affecting an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the API Page Sort Endpoint component. Manipulation of the pages argument can lead to SQL injection. The attack may be launched remotely.
Original NVD description (English source)
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS