CVE-2026-84974: code16/sharp: Arbitrary class instantiation through the embed_key API parameter
Impact
An authenticated attacker can instantiate any class in the PHP application by using the embedkey parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.
Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that embedkey is a class extending SharpFormEditorEmbed before any instantiation.
Workarounds
No known workarounds.
Other sources
code16/sharp: Arbitrary class instantiation through the embedkey API parameter
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 10.0.0-beta.4 - Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 9.23.0 - Upgrade
Upgrade
code16/sharpto a version that resolves this vulnerability.Fixed in 9.23.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send requests to API endpoints that accept the embed_key parameter. The issue is network-reachable and does not require user interaction.
What can an attacker do through embed_key?
The attacker can cause the Laravel container to instantiate arbitrary classes in the PHP application, invoking their constructors and resolving constructor dependencies. They cannot choose constructor parameter values or invoke arbitrary methods.
Which versions contain a fix?
The issue is patched in version 9.23.0 and in pre-release version 10.0.0-beta.4. The fix verifies that embed_key names a class extending SharpFormEditorEmbed before instantiation.
Is there a workaround if upgrading is not immediately possible?
No known workaround is provided. Upgrading to a patched version is the stated remediation.