ShowDoc EUVD-2026-114724

The attacker must be an authenticated ShowDoc user able to create or edit a Mock entry (MockController::add) and later trigger its rendering (MockController::infoByKey); the Node-based mock service (mock/index.js) must be running. The root-level impact is specific to the official Docker image, where the pre-patch mock service ran as root - the fix adds a de-privileged 'mockmock' user, so even post-patch Docker runs mock unprivileged. Limiting factors: valid credentials with Mock-feature permission are required (PR:L, not unauthenticated), so multi-tenant or publicly-registerable instances are most at risk; non-Docker or wordpress-base deployments that do not start the mock service are not exposed via this path.

This is a genuine, actionable priority rather than CVSS inflation, but its severity is gated by one real precondition: authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that any authenticated user with access to the Mock feature can perform, yielding full vulnerable-system impact (VC:H/VI:H/VA:H) - effectively OS command execution, and specifically as root in the official Docker image. The vendor decision label is 'this_week', consistent with a serious RCE that is not an active-exploitation emergency. Signals are incomplete: no EPSS score and no KEV listing are present in the input, so exploitation probability cannot be quantified and active in-the-wild use is not confirmed. A public PoC reference exists (a GitHub gist) but is not verified as working exploit code, so it should raise urgency over a theoretical bug without being treated as confirmed weaponization. Net: treat as a high-priority patch for any internet-exposed or multi-tenant ShowDoc instance, tempered by the fact that an attacker must first hold a valid account able to create Mock entries.

An attacker who holds any authenticated ShowDoc account that can use the Mock feature submits a crafted mockjs template via MockController::add, using escaped parentheses so the payload survives storage but is later evaluated by mockjs's eval()-backed placeholder handling. When the mock is rendered through MockController::infoByKey, the embedded code executes shell commands on the host - as root in the official Docker image. A public PoC reference (gist) exists but is not verified as working exploit code.