A vulnerability was determined in star7th ShowDoc up to 2

CVE-2026-6982 is an SQL injection flaw in ShowDoc's API Page Sort endpoint, specifically in server/Application/Api/Controller/PageController.class.PHP, where the pages argument can be manipulated. Authoritative advisories describe affected releases as ShowDoc up to 2.10.10, 3.6.2, and 3.8.0; GitHub and GitLab package advisories flatten that to all versions before 3.8.1, with 3.8.1 listed as the fix and no backports for older branches.

The vendor's MEDIUM label is technically defensible in a lab, but too generous for enterprise patch priority. The decisive friction is attacker position: exploitation requires authenticated access at minimum, and in real deployments ShowDoc is a niche internal documentation app rather than a broadly exposed edge service. No KEV listing, no active exploitation evidence for this CVE, and a near-zero EPSS push this down into backlog territory unless you deliberately expose ShowDoc to the internet.

Why this verdict

• Baseline down from 6.3: vendor CVSS assumes a generic networked app, but this product is a niche documentation platform with a smaller exposed population than common enterprise edge software.
• Authenticated remote only: PR:L means the attacker needs a valid user context. That implies stolen credentials, insider access, or a prior compromise stage — each one compounds downward pressure on severity.
• Limited impact profile: both published v3.1 and v4 vectors rate only low confidentiality, integrity, and availability impact with no scope change, which is a poor fit for emergency patching.
• No exploitation heat: no KEV listing, no public evidence of active exploitation for this CVE, and the provided EPSS 0.00012 is negligible.
• Patch path is straightforward but not urgent: there is a clean fixed version in 3.8.1, but absence of backports does not itself make this high priority; it just simplifies inventory decisions.

Why not higher?

To score higher, this would need an amplifier such as unauthenticated access, mass internet exposure, confirmed exploitation, or server-level compromise. The public record instead shows an authenticated bug with low CIA impact in a relatively niche app, which is exactly the kind of issue that looks scarier in CVSS math than in patch-ops reality.

Why not lower?

It is still a genuine injection flaw reachable over the network once an attacker is signed in, and public PoC references exist. If you run ShowDoc on the public internet or use weak local accounts without SSO/MFA, the practical risk rises enough that dismissing it entirely would be sloppy.

1. Keep ShowDoc off the public internet — Put the app behind VPN, ZTNA, or an internal reverse proxy so PR:L remains a meaningful barrier instead of a thin web-login speed bump. For a LOW verdict there is no formal SLA; treat this as backlog hygiene and enforce the exposure reduction in your next normal app-hardening cycle.
2. Front it with SSO and MFA — Because this bug needs authenticated access, stronger identity controls do real work here. Require enterprise SSO, remove local long-lived credentials where possible, and roll this into your routine IAM control baseline rather than an emergency change.
3. Constrain database privileges — Make sure the ShowDoc database user has only the minimum rights needed by the app. That limits what an injection can read or modify if someone does get a valid session and reach the vulnerable endpoint.
4. Log and inspect the Page Sort endpoint — Capture authenticated requests hitting the API Page Sort workflow and alert on obvious SQL metacharacters or anomalous sort operations. This is a practical detective control while you work the upgrade through normal change control.
5. Inventory and retire stray instances — The bigger operational risk with ShowDoc is forgotten self-hosted installs. Fold discovery into your backlog hygiene process and make owners either upgrade to 3.8.1+ or decommission the instance.

Run this on the ShowDoc host or container filesystem with read access to the application directory. Invoke it as bash check_showdoc_cve_2026_6982.sh /opt/showdoc or point it at the mounted app root; root is not required unless the files are restricted. The script tries git metadata first, then Docker image tags, then common file scraping, and returns VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_showdoc_cve_2026_6982.sh
# Determine likely exposure to CVE-2026-6982 in self-hosted ShowDoc.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE

set -u

TARGET="${1:-}"
FIXED="3.8.1"

usage() {
  echo "Usage: $0 <showdoc_root_path_or_docker_container_name>"
  exit 3
}

normalize_ver() {
  echo "$1" | sed -E 's/^[^0-9]*//; s/[^0-9.].*$//'
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

extract_from_git() {
  local root="$1"
  if command -v git >/dev/null 2>&1 && [ -d "$root/.git" ]; then
    git -C "$root" describe --tags --abbrev=0 2>/dev/null | sed 's/^v//'
    return 0
  fi
  return 1
}

extract_from_docker() {
  local name="$1"
  if command -v docker >/dev/null 2>&1; then
    local image
    image=$(docker inspect --format '{{.Config.Image}}' "$name" 2>/dev/null || true)
    if [ -n "$image" ]; then
      echo "$image" | awk -F: '{print $NF}' | sed 's/^v//'
      return 0
    fi
  fi
  return 1
}

extract_from_files() {
  local root="$1"
  local candidate=""

  # Common places admins may preserve a release string
  for f in \
    "$root/README.md" \
    "$root/docker-compose.yml" \
    "$root/composer.lock" \
    "$root/composer.json" \
    "$root/index.php"; do
    if [ -f "$f" ]; then
      candidate=$(grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+' "$f" 2>/dev/null | sed 's/^v//' | sort -V | tail -n1)
      if [ -n "$candidate" ]; then
        echo "$candidate"
        return 0
      fi
    fi
  done

  return 1
}

check_layout() {
  local root="$1"
  [ -f "$root/server/Application/Api/Controller/PageController.class.PHP" ]
}

[ -n "$TARGET" ] || usage

VERSION=""
MODE=""

if [ -d "$TARGET" ]; then
  if ! check_layout "$TARGET"; then
    echo "UNKNOWN - path does not look like a ShowDoc application root: $TARGET"
    exit 2
  fi

  VERSION=$(extract_from_git "$TARGET" || true)
  if [ -n "$VERSION" ]; then
    MODE="git"
  else
    VERSION=$(extract_from_files "$TARGET" || true)
    if [ -n "$VERSION" ]; then
      MODE="file"
    fi
  fi
else
  VERSION=$(extract_from_docker "$TARGET" || true)
  if [ -n "$VERSION" ]; then
    MODE="docker"
  fi
fi

VERSION=$(normalize_ver "$VERSION")

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - unable to determine ShowDoc version from git, docker image tag, or common files"
  exit 2
fi

if ver_lt "$VERSION" "$FIXED"; then
  echo "VULNERABLE - detected ShowDoc version $VERSION via $MODE; fixed version is $FIXED"
  exit 1
else
  echo "PATCHED - detected ShowDoc version $VERSION via $MODE; fixed version is $FIXED"
  exit 0
fi

Sources

1. NVD CVE-2026-6982
2. GitHub Advisory GHSA-fm5r-cj7v-rj2c
3. GitLab Advisory Database for CVE-2026-6982
4. ShowDoc release v3.8.1
5. CIRCL Vulnerability Lookup CVE-2026-6982
6. FIRST EPSS project
7. CISA Known Exploited Vulnerabilities Catalog
8. The Hacker News on ShowDoc exposure population