CODE16/SHARP · CVE-2026-84974 · Package
FIX → 10.0.0-beta.4 · 9.23.0
The code16/sharp Laravel admin package lets an authenticated user make the Laravel container construct any PHP class through the embed_key API parameter. Constructor dependencies are resolved, so an attacker can trigger constructor side effects, but cannot set parameter values or call arbitrary methods.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the code16/sharp package in the affected version ranges and expose its API to authenticated users. The advisory says the attacker must be authenticated and that the embed_key parameter is reachable across multiple API endpoints. Teams not running Sharp, or running a fixed version, are not affected.
Not affected if fixed-version, no-sharp
Who cares composer, laravel, php, sharp
composer show code16/sharp and compare it against the fixed versions below.composer.lock for code16/sharp to confirm the resolved version.Upgrade to 10.0.0-beta.4 · 9.23.0
An authenticated attacker can instantiate any class in the PHP application by using the embed_key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the __construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that embed_key is a class extending SharpFormEditorEmbed before any instantiation.
No known workarounds.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
code16/sharp 9.x: upgrade to 9.23.0.code16/sharp 10.0.0 pre-releases: upgrade to 10.0.0-beta.4.GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.