---
id: "CVE-2026-84987"
page: "https://infrastack.ai/live/CVE-2026-84987"
kind: "vulnerability"
aliases: ["CVE-2026-84987", "GHSA-g6f8-c3x9-jv7f"]
title: "code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "code16/sharp", "fixed": ["9.23.0"], "affected": "< 9.23.0", "ecosystem": "composer"}, {"name": "code16/sharp", "fixed": ["10.0.0-beta.4"], "affected": ">= 10.0.0-beta.1, < 10.0.0-beta.4", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["composer", "cwe-625", "cwe-918", "laravel", "package", "php", "sharp"]
not_affected_if: ["no-autocomplete-remote-endpoint", "unauthenticated-only", "uses-remote-callback"]
published_at: "2026-11-12T18:21:00+00:00"
first_seen_at: "2026-11-12T18:25:12+00:00"
updated_at: "2026-11-12T18:25:54+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-g6f8-c3x9-jv7f", "first_seen_at": "2026-11-12T18:25:12+00:00"}]
exploit_sources: []
---

# code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check

Link for people: https://infrastack.ai/live/CVE-2026-84987 (this .md is for agents)

Sharp, a PHP admin framework for Laravel, checks the autocomplete endpoint with an unanchored regex, so a substring of the configured endpoint can be used to request a different server-side route. An authenticated attacker can make the server send requests to internal or other routes, which is a server-side request forgery.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:code16/sharp affected < 9.23.0 fixed 9.23.0
- composer:code16/sharp affected >= 10.0.0-beta.1, < 10.0.0-beta.4 fixed 10.0.0-beta.4

## How to check

- Check the installed version with `composer show code16/sharp`
- Search the project for `setRemoteEndpoint` in Sharp form autocomplete fields
- Versions below `9.23.0` and from `10.0.0-beta.1` up to `10.0.0-beta.4` are affected

## Fix

- code16/sharp: upgrade to `9.23.0` or later in the 9.x line
- code16/sharp 10.x pre-release: upgrade to `10.0.0-beta.4`
- Workaround stated by the source: use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`

## Timeline

- 2026-11-12T18:25:12+00:00 ghsa https://github.com/advisories/GHSA-g6f8-c3x9-jv7f

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/code16/sharp/security-advisories/GHSA-g6f8-c3x9-jv7f
- [advisory] Maintainer's advisory: github.com https://github.com/code16/sharp/security/advisories/GHSA-g6f8-c3x9-jv7f
- [fix] Patch: github.com https://github.com/code16/sharp/pull/748
- [fix] Patch: github.com https://github.com/code16/sharp/commit/339f89110f36d06eaad3f2b4bd048fa5424e5558
- [fix] Release: github.com https://github.com/code16/sharp/releases/tag/v9.23.0

## From the sources

### Impact
An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.

### Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.

### Workarounds
Use `SharpFormAutocompleteRemoteField::setRemoteCallback()` instead of `SharpFormAutocompleteRemoteField::setRemoteEndpoint()`.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_