CVE-2026-6982: SQL Injection Vulnerability in ShowDoc API Page Sort Endpoint
Summary
CVE-2026-6982: ShowDoc has an Injection vulnerability. Affects showdoc/showdoc versions < 3.8.1. Fixed in 3.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ShowDoc is an open-source documentation management tool that allows users to create and manage documentation collaboratively. It provides features such as markdown support, API documentation, and a user-friendly interface. However, versions up to 2.10.10, 3.6.2, and 3.8.0 are vulnerable to an SQL injection attack through the API Page Sort Endpoint, which can be exploited remotely.
Vulnerability Detail
A vulnerability exists in the ShowDoc application, specifically in the PageController.class.PHP file of the API Page Sort Endpoint. By manipulating the 'pages' argument, an attacker can execute SQL injection attacks, potentially leading to unauthorized access to the database and sensitive information. This vulnerability affects versions up to 3.8.0 and can be exploited remotely, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.8.1
This is the first release that contains the fix.
composer require showdoc/showdoc:3.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict access to the API Page Sort Endpoint until the package can be updated. This can be done by implementing access controls or disabling the endpoint in the application configuration.
Conclusion
The SQL injection vulnerability identified as CVE-2026-6982 in ShowDoc poses a significant risk to users of affected versions. It is crucial to upgrade to version 3.8.1 or later to mitigate this risk. Users should also consider implementing temporary workarounds to secure their applications until they can perform the update.
See every vulnerability recorded for showdoc/showdoc →
FAQ
CVE-2026-6982 is a vulnerability in the ShowDoc application that allows for SQL injection through the API Page Sort Endpoint.
The affected versions are ShowDoc up to 2.10.10, 3.6.2, and 3.8.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to the database, data leakage, and potential compromise of sensitive information.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for showdoc/showdoc.
