CVE-2026-84987: code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route.
Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying the endpoint has been anchored to forbid substring injection.
Workarounds Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 10.0.0-beta.4 - Upgrade
Upgrade
composer/code16/sharpto a version that resolves this vulnerability.Fixed in 9.23.0 - Upgrade
Upgrade
code16/sharpto a version that resolves this vulnerability.Fixed in 9.23.0 - Upgrade
Upgrade
code16/sharpto a version that resolves this vulnerability.Fixed in 10.0.0-beta.4 - Configuration
Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint().
SharpFormAutocompleteRemoteField remote endpoint method = setRemoteCallback()
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Sharp autocomplete fields configured with SharpFormAutocompleteRemoteField::setRemoteEndpoint() are affected. Exploitation requires an authenticated attacker.
What does an attacker need to do to exploit this issue?
The attacker needs access as an authenticated user and must be able to call the Autocomplete API. They can use the configured endpoint as a substring to cause a request to another server-side route.
What versions contain a fix?
The issue is patched in version 9.23.0 and pre-release version 10.0.0-beta.4.
What can be done if updating is not immediately possible?
Replace SharpFormAutocompleteRemoteField::setRemoteEndpoint() with SharpFormAutocompleteRemoteField::setRemoteCallback().