CVE-2026-86644
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in star7th showdoc up to 3.9.1 affects unknown code in the file web_src/public/editor.md/editormd.js of the API Page Save Endpoint. Manipulation can lead to cross-site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 resolves the issue. The patch sets Mermaid 'securityLevel' to 'strict', disables 'htmlLabels', and sanitizes rendered SVG with DOMPurify.
Risk Assessment
An attacker can exploit XSS to execute scripts in the victim's browser, potentially leading to session theft, data theft, or account takeover. Since the exploit is public, the risk is elevated.
Recommendation
Update showdoc to version 3.9.2 or later immediately. Also, restrict API access and monitor logs for suspicious requests.
Other vulnerabilities in showdoc
See all- CVE-2025-0520Critical
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution. This issue affects ShowDoc before 2.8.7.
- CVE-2026-120203High
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval(), then trigger it through MockController::infoByKey to run commands, as root in the official Docker image.
- CVE-2026-119661Medium
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. An authenticated attacker can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
- CVE-2026-6982Medium
A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0 affecting an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the API Page Sort Endpoint component. Manipulation of the pages argument can lead to SQL injection. The attack may be launched remotely.
Original NVD description (English source)
A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS