---
id: "CVE-2026-84974"
page: "https://infrastack.ai/live/CVE-2026-84974"
kind: "vulnerability"
aliases: ["CVE-2026-84974", "GHSA-h24v-f482-8cwf"]
title: "code16/sharp: Arbitrary class instantiation through the embed_key API parameter"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "code16/sharp", "fixed": ["9.23.0"], "affected": "< 9.23.0", "ecosystem": "composer"}, {"name": "code16/sharp", "fixed": ["10.0.0-beta.4"], "affected": ">= 10.0.0-beta.1, < 10.0.0-beta.4", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["composer", "cwe-470", "laravel", "package", "php", "sharp"]
not_affected_if: ["fixed-version", "no-sharp"]
published_at: "2026-11-12T18:18:44+00:00"
first_seen_at: "2026-11-12T18:20:03+00:00"
updated_at: "2026-11-12T18:21:45+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h24v-f482-8cwf", "first_seen_at": "2026-11-12T18:20:03+00:00"}]
exploit_sources: []
---

# code16/sharp: Arbitrary class instantiation through the embed_key API parameter

Link for people: https://infrastack.ai/live/CVE-2026-84974 (this .md is for agents)

The code16/sharp Laravel admin package lets an authenticated user make the Laravel container construct any PHP class through the embed_key API parameter. Constructor dependencies are resolved, so an attacker can trigger constructor side effects, but cannot set parameter values or call arbitrary methods.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:code16/sharp affected < 9.23.0 fixed 9.23.0
- composer:code16/sharp affected >= 10.0.0-beta.1, < 10.0.0-beta.4 fixed 10.0.0-beta.4

## How to check

- Check the installed version with `composer show code16/sharp` and compare it against the fixed versions below.
- Look in `composer.lock` for `code16/sharp` to confirm the resolved version.

## Fix

- `code16/sharp` 9.x: upgrade to `9.23.0`.
- `code16/sharp` 10.0.0 pre-releases: upgrade to `10.0.0-beta.4`.

## Timeline

- 2026-11-12T18:20:03+00:00 ghsa https://github.com/advisories/GHSA-h24v-f482-8cwf

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/code16/sharp/security-advisories/GHSA-h24v-f482-8cwf
- [advisory] Maintainer's advisory: github.com https://github.com/code16/sharp/security/advisories/GHSA-h24v-f482-8cwf
- [fix] Patch: github.com https://github.com/code16/sharp/pull/750
- [fix] Patch: github.com https://github.com/code16/sharp/commit/dfafb44b11574e621bf0785f02c32b9866ab9923
- [fix] Release: github.com https://github.com/code16/sharp/releases/tag/v9.23.0

## From the sources

### Impact

An authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.

### Patches

The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that `embed_key` is a class extending `SharpFormEditorEmbed` before any instantiation.

### Workarounds

No known workarounds.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_