TI-2026-06110 Aliases CVE-2026-6982 GHSA-fm5r-cj7v-rj2c

star7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injection

LOW 24CWE-74Published 2026-04-25 · Updated 2026-04-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the component API Page Sort Endpoint. Executing a manipulation of the argument pages can lead to sql injection. The attack may be launched remotely. Upgrading to version 3.8.1 addresses this issue. It is suggested to upgrade the affected component. According to the researcher, "[t]he vendor explicitly stated they will not backport patches to the older affected versions."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00241 15th percentileScored 2026-11-07

Fix Fixed ShowDoc (star7th): 3.8.1showdoc/showdoc (Packagist): 3.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
star7th	ShowDoc	2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.6.0; 3.6.1; 3.6.2; 3.7; 3.8.0	3.8.1	Patch available	CNA
—	showdoc/showdoc (Packagist)	before 3.8.1	3.8.1	Patch available	GHSA-fm5r-cj7v-rj2c

ShowDoc Vendorstar7th Affected 2.10.0; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6; 2.10.7; 2.10.8; 2.10.9; 2.10.10; 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.6.0; 3.6.1; 3.6.2; 3.7; 3.8.0 Fixed in 3.8.1 Patch available CNA
showdoc/showdoc (Packagist) Vendor— Affected before 3.8.1 Fixed in 3.8.1 Patch available GHSA-fm5r-cj7v-rj2c

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:showdoc:showdoc::::::::	—	—	star7th

cpe:2.3:a:showdoc:showdoc:*:*:*:*:*:*:*:* Versions — — ·star7th

Remediation

Fix · CNA ShowDoc (star7th) Fixed in 3.8.1
Fix · GHSA-fm5r-cj7v-rj2c showdoc/showdoc (Packagist) Fixed in 3.8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-6982
2026-10-03 Alias added: GHSA-fm5r-cj7v-rj2c

References

Patch 1

https://github.com/star7th/showdoc/releases/tag/v3.8.1

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-6982

Other 2

TI-2025-00432 ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution CVSS 4.0CRITICAL 9.4
TI-2026-59246 star7th showdoc API Page Save Endpoint editormd.js cross site scripting CVSS 4.0MEDIUM 5.1
TI-2021-14768 Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2022-00287 SQL Injection in star7th/showdoc CVSS 3.1CRITICAL 9.8
TI-2021-18398 ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions. CVSS 3.1CRITICAL 9.8
TI-2026-83553 Code injection in ShowDoc Mock templates lets users run commands CVSS 4.0HIGH 8.7

See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences