Stored Cross-site Scripting in showdoc

MEDIUM 5.4CVE-2022-0967 · GHSA-3pg8-c473-w6rr · Published 15/03/2022 · updated 17/06/2026

In short

CVE-2022-0967 is a MEDIUM (CVSS 5.4) vulnerability affecting showdoc/showdoc, showdoc (showdoc).
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.4% of all vulnerabilities.
Fix: update to 2.10.4 or later.

Package	Affected versions	Patched versions
showdoc/showdoc Packagist	`< 2.10.4`	`2.10.4`
showdoc showdoc	`< 2.10.4`	`2.10.4`

Description

ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.

NVD description

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

References

nvd.nist.gov/vuln/detail/CVE-2022-0967 · ADVISORY
star7th/showdoc commit 3caa323 · WEB
star7th/showdoc · PACKAGE
huntr.dev/bounties/9dea3c98-7609-480d-902d-149067bd1e2a · WEB
packetstormsecurity.com/files/167198/Showdoc-2.10.3-Cross-Site-Scripting.html · Exploit

More vulnerabilities in showdoc/showdoc

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

showdoc/showdoc

Packagist

< 2.10.4

2.10.4

showdoc

< 2.10.4

2.10.4

Description

NVD description

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

More vulnerabilities in showdoc/showdoc

See all →