CVE-2026-120203

Summary

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature where authenticated users can inject and execute arbitrary shell commands via mockjs templates that use eval() on user-controlled input containing escaped parentheses.

Exploitability

Exploitation requires valid authentication and the ability to submit a malicious mockjs template through the MockController::add endpoint, but is otherwise straightforward due to lack of input sanitization.

Blast radius

In the official Docker image, exploitation allows full system compromise as root, enabling data exfiltration, lateral movement, or persistence.

Detection

Defenders should monitor for HTTP POST requests to /index.php/mock/add containing suspicious patterns such as escaped parentheses (e.g., \(\)) in the template body, followed by subsequent GET requests to /index.php/mock/infoByKey referencing the same mock key; these logs may indicate attempted exploitation.

Prioritized remediation

Upgrade to ShowDoc version 3.9.6 or later, which patches the vulnerability by sanitizing mockjs template inputs before evaluation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.