{"id":"CVE-2026-120203","kind":"vulnerability","aliases":["CVE-2026-120203"],"related":[],"title":"ShowDoc: Mock feature lets logged-in users run shell commands","description":"ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.","summary":"ShowDoc is a self-hosted API documentation tool. An authenticated user can store a crafted mockjs template that the server evaluates, letting them run shell commands on the server, as root in the official Docker image.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","package","php","self-hosted","showdoc"],"not_affected_if":["managed-hosting","version-3.9.6-or-later"],"how_to_check":"- Check the ShowDoc version in use; affected versions are `2.8.14` up to but not including `3.9.6`.\n- If running the official Docker image, check the image tag and whether processes run as root.","fix":"- Move to ShowDoc `3.9.6` or later.","status":"open","published_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","triaged_at":"2026-10-31T18:38:35+00:00","updated_at":"2026-10-31T18:38:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T18:38:35Z","model":"claude-haiku-5-5","output":{"fix":"- Move to ShowDoc `3.9.6` or later.","reach":"network","title":"ShowDoc: Mock feature lets logged-in users run shell commands","impact":"high","summary":"ShowDoc is a self-hosted API documentation tool. An authenticated user can store a crafted mockjs template that the server evaluates, letting them run shell commands on the server, as root in the official Docker image.","audience":"businesses","category":"package","nicknames":[],"who_cares":["showdoc","self-hosted","docker","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Shell commands run on the server as root in Docker","analyst_note":"","how_to_check":"- Check the ShowDoc version in use; affected versions are `2.8.14` up to but not including `3.9.6`.\n- If running the official Docker image, check the image tag and whether processes run as root.\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.9.6-or-later","managed-hosting"],"who_is_affected":"Teams that self-host ShowDoc between versions 2.8.14 and 3.9.6 are exposed, especially where any user account can reach the Mock feature. Hosted or managed ShowDoc instances are the vendor's responsibility and are not described in the sources. Instances already on 3.9.6 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4162,"output_tokens":520,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120203':14A,17A '-2026':13A,16A '2.8.14':63C '3.9.6':65C 'add':93C 'allow':76C 'api':31B 'attack':86C 'authent':35B,77C 'code':68C 'command':11A,51B,82C,110C 'contain':66C 'craft':40B 'cve':12A,15A 'docker':18B,60B,116C 'document':32B 'escap':95C 'eval':101C 'evalu':46B,99C 'execut':80C 'featur':3A,74C 'host':23B,30B 'imag':61B,117C 'infobykey':107C 'inject':69C 'let':4A,47B 'log':6A 'logged-in':5A 'mock':2A,73C 'mockcontrol':92C,106C 'mockj':41B,84C,98C 'offici':59B,115C 'packag':19B 'parenthes':96C 'php':20B 'root':56B,112C 'run':9A,49B,109C 'self':22B,29B 'self-host':21B,28B 'server':45B,54B 'shell':10A,50B,81C 'showdoc':1A,24B,25B,62C 'store':38B,88C 'templat':42B,85C,90C 'tool':33B 'trigger':103C 'user':8A,36B,78C 'via':91C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host ShowDoc between versions 2.8.14 and 3.9.6 are exposed, especially where any user account can reach the Mock feature. Hosted or managed ShowDoc instances are the vendor's responsibility and are not described in the sources. Instances already on 3.9.6 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120203","severity":null,"published_at":"2026-10-31T18:17:08+00:00","modified_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","fetched_at":"2026-10-31T18:37:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}