{"id":"CVE-2026-84987","kind":"vulnerability","aliases":["CVE-2026-84987","GHSA-g6f8-c3x9-jv7f"],"related":[],"title":"code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check","description":"### Impact\nAn authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.\n\n### Patches\nThe problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.\n\n### Workarounds\nUse `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.","summary":"Sharp, a PHP admin framework for Laravel, checks the autocomplete endpoint with an unanchored regex, so a substring of the configured endpoint can be used to request a different server-side route. An authenticated attacker can make the server send requests to internal or other routes, which is a server-side request forgery.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code16/sharp","fixed":["9.23.0"],"affected":"< 9.23.0","ecosystem":"composer"},{"name":"code16/sharp","fixed":["10.0.0-beta.4"],"affected":">= 10.0.0-beta.1, < 10.0.0-beta.4","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["composer","cwe-625","cwe-918","laravel","package","php","sharp"],"not_affected_if":["no-autocomplete-remote-endpoint","unauthenticated-only","uses-remote-callback"],"how_to_check":"- Check the installed version with `composer show code16/sharp`\n- Search the project for `setRemoteEndpoint` in Sharp form autocomplete fields\n- Versions below `9.23.0` and from `10.0.0-beta.1` up to `10.0.0-beta.4` are affected","fix":"- code16/sharp: upgrade to `9.23.0` or later in the 9.x line\n- code16/sharp 10.x pre-release: upgrade to `10.0.0-beta.4`\n- Workaround stated by the source: use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`","status":"open","published_at":"2026-11-12T18:21:00+00:00","first_seen_at":"2026-11-12T18:25:12+00:00","triaged_at":"2026-11-12T18:25:54+00:00","updated_at":"2026-11-12T18:25:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T18:25:54Z","model":"claude-haiku-5-5","output":{"fix":"- code16/sharp: upgrade to `9.23.0` or later in the 9.x line\n- code16/sharp 10.x pre-release: upgrade to `10.0.0-beta.4`\n- Workaround stated by the source: use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`","reach":"internet","title":"Sharp (Laravel admin): autocomplete endpoint check lets a user reach other server routes","impact":"medium","summary":"Sharp, a PHP admin framework for Laravel, checks the autocomplete endpoint with an unanchored regex, so a substring of the configured endpoint can be used to request a different server-side route. An authenticated attacker can make the server send requests to internal or other routes, which is a server-side request forgery.","audience":"developers","category":"package","nicknames":[],"who_cares":["laravel","php","sharp","composer"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user makes server request other internal routes","analyst_note":"","how_to_check":"- Check the installed version with `composer show code16/sharp`\n- Search the project for `setRemoteEndpoint` in Sharp form autocomplete fields\n- Versions below `9.23.0` and from `10.0.0-beta.1` up to `10.0.0-beta.4` are affected","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-autocomplete-remote-endpoint","uses-remote-callback","unauthenticated-only"],"who_is_affected":"Applications that use Sharp's autocomplete remote fields configured with setRemoteEndpoint, where users are logged in to the admin panel. Applications that do not use autocomplete remote endpoints, or that already use setRemoteCallback, are not exposed through this path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000837,"input_tokens":4815,"output_tokens":711,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-625':28B '-84987':15A,23A '-918':30B '10.0.0':126C '9.23.0':120C 'admin':38B 'anchor':135C 'anoth':108C 'api':98C 'attack':70B,93C 'authent':69B,92C 'autocomplet':10A,44B,97C 'beta.4':127C 'c3x9':19A 'call':95C 'check':12A,42B 'code16/sharp':1A,24A,25A 'compos':26B 'configur':55B,101C 'cve':13A,21A 'cwe':27B,29B 'differ':63B 'endpoint':11A,45B,56B,102C,132C 'forbid':137C 'forgeri':6A,89B 'framework':39B 'g6f8':18A 'ghsa':17A 'ghsa-g6f8-c3x9-jv7f':16A 'impact':90C 'inject':139C 'instead':144C 'intern':78B 'jv7f':20A 'laravel':31B,41B 'make':72B 'packag':32B 'patch':113C,118C 'php':33B,37B 'pre':123C 'pre-releas':122C 'problem':115C 'regex':49B,129C 'releas':124C 'request':5A,61B,76B,88B,107C 'rout':67B,81B,112C 'send':75B 'server':3A,65B,74B,86B,110C 'server-sid':2A,64B,85B,109C 'setremotecallback':143C 'setremoteendpoint':147C 'sharp':34B,35B 'sharpformautocompleteremotefield':142C,146C 'side':4A,66B,87B,111C 'substr':52B,105C,138C 'unanchor':9A,48B 'use':59B,141C 'verifi':130C 'version':125C 'workaround':140C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Sharp's autocomplete remote fields configured with setRemoteEndpoint, where users are logged in to the admin panel. Applications that do not use autocomplete remote endpoints, or that already use setRemoteCallback, are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["code16sharp"],"ptokens":["code16","sharp"],"labels":["composer","cwe625","cwe918","laravel","medium","package","php","sharp"],"campaign_type":null,"search_a":"'-2026':14A,22A '-84987':15A,23A 'autocomplet':10A 'c3x9':19A 'check':12A 'code16/sharp':1A,24A,25A 'cve':13A,21A 'endpoint':11A 'forgeri':6A 'g6f8':18A 'ghsa':17A 'ghsa-g6f8-c3x9-jv7f':16A 'jv7f':20A 'request':5A 'server':3A 'server-sid':2A 'side':4A 'unanchor':9A","search_b":"'-625':28B '-918':30B 'admin':38B 'attack':70B 'authent':69B 'autocomplet':44B 'check':42B 'compos':26B 'configur':55B 'cwe':27B,29B 'differ':63B 'endpoint':45B,56B 'forgeri':89B 'framework':39B 'intern':78B 'laravel':31B,41B 'make':72B 'packag':32B 'php':33B,37B 'regex':49B 'request':61B,76B,88B 'rout':67B,81B 'send':75B 'server':65B,74B,86B 'server-sid':64B,85B 'sharp':34B,35B 'side':66B,87B 'substr':52B 'unanchor':48B 'use':59B","search_c":"'10.0.0':126C '9.23.0':120C 'anchor':135C 'anoth':108C 'api':98C 'attack':93C 'authent':92C 'autocomplet':97C 'beta.4':127C 'call':95C 'configur':101C 'endpoint':102C,132C 'forbid':137C 'impact':90C 'inject':139C 'instead':144C 'patch':113C,118C 'pre':123C 'pre-releas':122C 'problem':115C 'regex':129C 'releas':124C 'request':107C 'rout':112C 'server':110C 'server-sid':109C 'setremotecallback':143C 'setremoteendpoint':147C 'sharpformautocompleteremotefield':142C,146C 'side':111C 'substr':105C,138C 'use':141C 'verifi':130C 'version':125C 'workaround':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:21:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-g6f8-c3x9-jv7f","url":"https://github.com/advisories/GHSA-g6f8-c3x9-jv7f","severity":"medium","published_at":"2026-11-12T18:21:00+00:00","modified_at":"2026-11-12T18:21:01+00:00","first_seen_at":"2026-11-12T18:25:12+00:00","fetched_at":"2026-11-12T19:01:02+00:00","note":null}],"documents":[{"id":137256,"url":"https://api.github.com/repos/code16/sharp/security-advisories/GHSA-g6f8-c3x9-jv7f","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":137257,"url":"https://github.com/code16/sharp/security/advisories/GHSA-g6f8-c3x9-jv7f","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":137258,"url":"https://github.com/code16/sharp/pull/748","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137259,"url":"https://github.com/code16/sharp/commit/339f89110f36d06eaad3f2b4bd048fa5424e5558","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137249,"url":"https://github.com/code16/sharp/releases/tag/v9.23.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}