CVE-2026-84974: code16/sharp: Arbitrary class instantiation through the embed_key API parameter
An authenticated attacker can instantiate any class in the PHP application by using the embed_key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the __construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.
References
- github.com/advisories/GHSA-h24v-f482-8cwf
- github.com/code16/sharp/commit/dfafb44b11574e621bf0785f02c32b9866ab9923
- github.com/code16/sharp/pull/750
- github.com/code16/sharp/releases/tag/v9.23.0
- github.com/code16/sharp/security/advisories/GHSA-h24v-f482-8cwf
- github.com/code16/sharp/tree/v10.0.0-beta.4
- nvd.nist.gov/vuln/detail/CVE-2026-84974
Code Behaviors & Features
Detect and mitigate CVE-2026-84974 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →