Threats affecting pkg:composer/ShowDoc

ShowDoc versions from 2.8.14 up to but not including 3.9.6 contain a code injection vulnerability in the Mock feature. Authenticated users can exploit this flaw by storing specially crafted mockjs templates that execute shell commands with root privileges in the official Docker image. The vulnerability is fixed in version 3.9.6.

ShowDoc versions up to 3.8.0 contain a SQL injection vulnerability in the API Page Sort Endpoint, specifically in the PageController.class.PHP file. This vulnerability allows remote attackers to manipulate the 'pages' argument to execute SQL injection attacks. The issue is fixed in version 3.8.1. The vendor has stated that patches will not be backported to older versions, so upgrading is necessary to remediate the vulnerability.