CVE-2026-84974
Published:November 12, 2026
Updated:November 13, 2026
An authenticated attacker can instantiate any class in the PHP application by using the "embed_key" parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the "__construct()" method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.
Affected Packages
https://github.com/code16/sharp.git (GITHUB):
Affected version(s) >=v10.0.0-beta.1 <v10.0.0-beta.4Fix Suggestion:
Update to version v10.0.0-beta.4https://github.com/code16/sharp.git (GITHUB):
Affected version(s) >=v7.7.0 <v9.23.0 || >=v8.0.0 <v9.23.0 || >=v9.0.0-alpha.1 <v9.23.0Fix Suggestion:
Update to version v9.23.0code16/sharp (PHP):
Affected version(s) >=v10.0.0-beta.1 <v10.0.0-beta.4Fix Suggestion:
Update to version v10.0.0-beta.4code16/sharp (PHP):
Affected version(s) >=v7.7.0 <v9.23.0 || >=v8.0.0 <v9.23.0 || >=v9.0.0-alpha.1 <v9.23.0Fix Suggestion:
Update to version v9.23.0Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Use of Externally-Controlled Input to Select Classes or Code