CODE16/SHARP · CVE-2026-84987 · Package
FIX → 10.0.0-beta.4 · 9.23.0
Sharp, a PHP admin framework for Laravel, checks the autocomplete endpoint with an unanchored regex, so a substring of the configured endpoint can be used to request a different server-side route. An authenticated attacker can make the server send requests to internal or other routes, which is a server-side request forgery.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use Sharp's autocomplete remote fields configured with setRemoteEndpoint, where users are logged in to the admin panel. Applications that do not use autocomplete remote endpoints, or that already use setRemoteCallback, are not exposed through this path.
Not affected if no-autocomplete-remote-endpoint, unauthenticated-only, uses-remote-callback
Who cares composer, laravel, php, sharp
composer show code16/sharpsetRemoteEndpoint in Sharp form autocomplete fields9.23.0 and from 10.0.0-beta.1 up to 10.0.0-beta.4 are affectedAn authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 10.0.0-beta.4 · 9.23.0
9.23.0 or later in the 9.x line10.0.0-beta.4SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint()GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.