{"id":"CVE-2026-84974","kind":"vulnerability","aliases":["CVE-2026-84974","GHSA-h24v-f482-8cwf"],"related":[],"title":"code16/sharp: Arbitrary class instantiation through the embed_key API parameter","description":"### Impact\n\nAn authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.\n\n### Patches\n\nThe problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that `embed_key` is a class extending `SharpFormEditorEmbed` before any instantiation.\n\n### Workarounds\n\nNo known workarounds.","summary":"The code16/sharp Laravel admin package lets an authenticated user make the Laravel container construct any PHP class through the embed_key API parameter. Constructor dependencies are resolved, so an attacker can trigger constructor side effects, but cannot set parameter values or call arbitrary methods.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code16/sharp","fixed":["9.23.0"],"affected":"< 9.23.0","ecosystem":"composer"},{"name":"code16/sharp","fixed":["10.0.0-beta.4"],"affected":">= 10.0.0-beta.1, < 10.0.0-beta.4","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","cwe-470","laravel","package","php","sharp"],"not_affected_if":["fixed-version","no-sharp"],"how_to_check":"- Check the installed version with `composer show code16/sharp` and compare it against the fixed versions below.\n- Look in `composer.lock` for `code16/sharp` to confirm the resolved version.","fix":"- `code16/sharp` 9.x: upgrade to `9.23.0`.\n- `code16/sharp` 10.0.0 pre-releases: upgrade to `10.0.0-beta.4`.","status":"open","published_at":"2026-11-12T18:18:44+00:00","first_seen_at":"2026-11-12T18:20:03+00:00","triaged_at":"2026-11-12T18:21:45+00:00","updated_at":"2026-11-12T18:21:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T18:21:45Z","model":"claude-haiku-5-5","output":{"fix":"- `code16/sharp` 9.x: upgrade to `9.23.0`.\n- `code16/sharp` 10.0.0 pre-releases: upgrade to `10.0.0-beta.4`.","reach":"internet","title":"Sharp (Laravel admin): authenticated users can instantiate arbitrary PHP classes","impact":"medium","summary":"The code16/sharp Laravel admin package lets an authenticated user make the Laravel container construct any PHP class through the embed_key API parameter. Constructor dependencies are resolved, so an attacker can trigger constructor side effects, but cannot set parameter values or call arbitrary methods.","audience":"developers","category":"package","nicknames":[],"who_cares":["laravel","php","sharp","composer"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user constructs arbitrary PHP classes via container","analyst_note":"","how_to_check":"- Check the installed version with `composer show code16/sharp` and compare it against the fixed versions below.\n- Look in `composer.lock` for `code16/sharp` to confirm the resolved version.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-sharp"],"who_is_affected":"Applications that use the code16/sharp package in the affected version ranges and expose its API to authenticated users. The advisory says the attacker must be authenticated and that the embed_key parameter is reachable across multiple API endpoints. Teams not running Sharp, or running a fixed version, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000783,"input_tokens":4838,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-470':26B '-84974':13A,21A '10.0.0':147C '8cwf':18A '9.23.0':141C 'across':93C 'add':153C 'addit':150C 'admin':34B 'api':9A,52B,95C 'applic':86C 'arbitrari':2A,73B,132C 'attack':60B,78C,123C 'authent':38B,77C 'beta.4':148C 'call':72B,115C,130C 'cannot':67B,124C,129C 'check':151C 'class':3A,47B,82C,113C,161C 'code16/sharp':1A,22A,23A,32B 'compos':24B 'construct':44B,109C 'constructor':54B,63B,118C 'contain':43B,104C 'cve':11A,19A 'cwe':25B 'depend':55B,119C 'effect':65B 'emb':7A,50B,90C,157C 'endpoint':96C 'extend':162C 'f482':17A 'ghsa':15A 'ghsa-h24v-f482-8cwf':14A 'h24v':16A 'impact':75C 'instanti':4A,80C,98C,166C 'key':8A,51B,91C,158C 'known':169C 'laravel':27B,33B,42B,103C 'let':36B 'make':40B 'method':74B,110C,133C 'multipl':94C 'packag':28B,35B 'paramet':10A,53B,69B,92C,126C 'patch':134C,139C 'perform':100C 'php':29B,46B,85C 'pre':144C 'pre-releas':143C 'problem':136C 'releas':145C 'resolv':57B,121C 'result':107C 'set':68B 'sharp':30B 'sharpformeditoremb':163C 'side':64B 'specifi':125C 'trigger':62B 'use':88C 'user':39B 'valu':70B,127C 'verifi':155C 'version':146C 'workaround':167C,170C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the code16/sharp package in the affected version ranges and expose its API to authenticated users. The advisory says the attacker must be authenticated and that the embed_key parameter is reachable across multiple API endpoints. Teams not running Sharp, or running a fixed version, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["code16sharp"],"ptokens":["code16","sharp"],"labels":["composer","cwe470","laravel","medium","package","php","sharp"],"campaign_type":null,"search_a":"'-2026':12A,20A '-84974':13A,21A '8cwf':18A 'api':9A 'arbitrari':2A 'class':3A 'code16/sharp':1A,22A,23A 'cve':11A,19A 'emb':7A 'f482':17A 'ghsa':15A 'ghsa-h24v-f482-8cwf':14A 'h24v':16A 'instanti':4A 'key':8A 'paramet':10A","search_b":"'-470':26B 'admin':34B 'api':52B 'arbitrari':73B 'attack':60B 'authent':38B 'call':72B 'cannot':67B 'class':47B 'code16/sharp':32B 'compos':24B 'construct':44B 'constructor':54B,63B 'contain':43B 'cwe':25B 'depend':55B 'effect':65B 'emb':50B 'key':51B 'laravel':27B,33B,42B 'let':36B 'make':40B 'method':74B 'packag':28B,35B 'paramet':53B,69B 'php':29B,46B 'resolv':57B 'set':68B 'sharp':30B 'side':64B 'trigger':62B 'user':39B 'valu':70B","search_c":"'10.0.0':147C '9.23.0':141C 'across':93C 'add':153C 'addit':150C 'api':95C 'applic':86C 'arbitrari':132C 'attack':78C,123C 'authent':77C 'beta.4':148C 'call':115C,130C 'cannot':124C,129C 'check':151C 'class':82C,113C,161C 'construct':109C 'constructor':118C 'contain':104C 'depend':119C 'emb':90C,157C 'endpoint':96C 'extend':162C 'impact':75C 'instanti':80C,98C,166C 'key':91C,158C 'known':169C 'laravel':103C 'method':110C,133C 'multipl':94C 'paramet':92C,126C 'patch':134C,139C 'perform':100C 'php':85C 'pre':144C 'pre-releas':143C 'problem':136C 'releas':145C 'resolv':121C 'result':107C 'sharpformeditoremb':163C 'specifi':125C 'use':88C 'valu':127C 'verifi':155C 'version':146C 'workaround':167C,170C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h24v-f482-8cwf","url":"https://github.com/advisories/GHSA-h24v-f482-8cwf","severity":"medium","published_at":"2026-11-12T18:18:44+00:00","modified_at":"2026-11-12T18:18:45+00:00","first_seen_at":"2026-11-12T18:20:03+00:00","fetched_at":"2026-11-12T18:25:53+00:00","note":null}],"documents":[{"id":137245,"url":"https://api.github.com/repos/code16/sharp/security-advisories/GHSA-h24v-f482-8cwf","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":137246,"url":"https://github.com/code16/sharp/security/advisories/GHSA-h24v-f482-8cwf","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":137247,"url":"https://github.com/code16/sharp/pull/750","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137248,"url":"https://github.com/code16/sharp/commit/dfafb44b11574e621bf0785f02c32b9866ab9923","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137249,"url":"https://github.com/code16/sharp/releases/tag/v9.23.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}