Search
Find a vulnerability
Search criteria
10 vulnerabilities by code16
CVE-2026-53634 (GCVE-0-2026-53634)
Vulnerability from nvd – Published: 2026-06-10 20:03 – Updated: 2026-06-11 14:17
VLAI
Title
Sharp: Missing Authorization Check in Quick Creation Command Endpoints
Summary
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/729 | x_refsource_MISC |
| https://github.com/code16/sharp/commit/aa18a85fd8… | x_refsource_MISC |
| https://github.com/code16/sharp/releases/tag/v9.22.3 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:17:08.204091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T14:17:22.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.22.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T20:03:33.950Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch"
},
{
"name": "https://github.com/code16/sharp/pull/729",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/729"
},
{
"name": "https://github.com/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.22.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.22.3"
}
],
"source": {
"advisory": "GHSA-vmwx-m75v-qvch",
"discovery": "UNKNOWN"
},
"title": "Sharp: Missing Authorization Check in Quick Creation Command Endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53634",
"datePublished": "2026-06-10T20:03:33.950Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-06-11T14:17:22.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44692 (GCVE-0-2026-44692)
Vulnerability from nvd – Published: 2026-06-10 20:03 – Updated: 2026-06-11 14:07
VLAI
Title
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
Summary
Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. This issue has been patched in version 9.22.0.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/releases/tag/v9.22.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:07:38.389163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T14:07:48.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. This issue has been patched in version 9.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T20:03:48.810Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-748w-hm6r-qc7v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-748w-hm6r-qc7v"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.22.0"
}
],
"source": {
"advisory": "GHSA-748w-hm6r-qc7v",
"discovery": "UNKNOWN"
},
"title": "Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44692",
"datePublished": "2026-06-10T20:03:48.810Z",
"dateReserved": "2026-05-07T17:07:09.315Z",
"dateUpdated": "2026-06-11T14:07:48.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33687 (GCVE-0-2026-33687)
Vulnerability from nvd – Published: 2026-03-26 21:47 – Updated: 2026-03-27 20:28
VLAI
Title
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
Summary
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. This issue has been addressed in version 9.20.0 by removing the client-controlled validation rules and strictly defining upload rules server-side. As a workaround, ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/714 | x_refsource_MISC |
| https://github.com/code16/sharp/releases/tag/v9.20.0 | x_refsource_MISC |
| https://laravel.com/docs/13.x/filesystem | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T20:28:24.566534Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T20:28:53.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. This issue has been addressed in version 9.20.0 by removing the client-controlled validation rules and strictly defining upload rules server-side. As a workaround, ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:53:26.004Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-fr76-5637-w3g9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-fr76-5637-w3g9"
},
{
"name": "https://github.com/code16/sharp/pull/714",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/714"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.20.0"
},
{
"name": "https://laravel.com/docs/13.x/filesystem",
"tags": [
"x_refsource_MISC"
],
"url": "https://laravel.com/docs/13.x/filesystem"
}
],
"source": {
"advisory": "GHSA-fr76-5637-w3g9",
"discovery": "UNKNOWN"
},
"title": "Sharp has Unrestricted File Upload via Client-Controlled Validation Rules"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33687",
"datePublished": "2026-03-26T21:47:55.573Z",
"dateReserved": "2026-03-23T16:34:59.932Z",
"dateUpdated": "2026-03-27T20:28:53.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33686 (GCVE-0-2026-33686)
Vulnerability from nvd – Published: 2026-03-26 21:54 – Updated: 2026-03-27 13:59
VLAI
Title
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
Summary
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/715 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T13:59:38.470602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T13:59:50.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file\u0027s extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:54:25.294Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958"
},
{
"name": "https://github.com/code16/sharp/pull/715",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/715"
}
],
"source": {
"advisory": "GHSA-9ffq-6457-8958",
"discovery": "UNKNOWN"
},
"title": "Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33686",
"datePublished": "2026-03-26T21:54:25.294Z",
"dateReserved": "2026-03-23T16:34:59.931Z",
"dateUpdated": "2026-03-27T13:59:50.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-62798 (GCVE-0-2025-62798)
Vulnerability from nvd – Published: 2025-10-28 20:58 – Updated: 2025-10-29 17:31
VLAI
Title
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax
Summary
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/654 | x_refsource_MISC |
| https://github.com/code16/sharp/releases/tag/v9.11.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-29T17:31:18.507828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-29T17:31:24.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ \u0026 }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 ."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-28T20:58:21.793Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7"
},
{
"name": "https://github.com/code16/sharp/pull/654",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/654"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.11.1"
}
],
"source": {
"advisory": "GHSA-9f58-4465-23c7",
"discovery": "UNKNOWN"
},
"title": "Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62798",
"datePublished": "2025-10-28T20:58:21.793Z",
"dateReserved": "2025-10-22T18:55:48.011Z",
"dateUpdated": "2025-10-29T17:31:24.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44692 (GCVE-0-2026-44692)
Vulnerability from cvelistv5 – Published: 2026-06-10 20:03 – Updated: 2026-06-11 14:07
VLAI
Title
Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint
Summary
Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. This issue has been patched in version 9.22.0.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/releases/tag/v9.22.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:07:38.389163Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T14:07:48.507Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. This issue has been patched in version 9.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T20:03:48.810Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-748w-hm6r-qc7v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-748w-hm6r-qc7v"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.22.0"
}
],
"source": {
"advisory": "GHSA-748w-hm6r-qc7v",
"discovery": "UNKNOWN"
},
"title": "Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44692",
"datePublished": "2026-06-10T20:03:48.810Z",
"dateReserved": "2026-05-07T17:07:09.315Z",
"dateUpdated": "2026-06-11T14:07:48.507Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53634 (GCVE-0-2026-53634)
Vulnerability from cvelistv5 – Published: 2026-06-10 20:03 – Updated: 2026-06-11 14:17
VLAI
Title
Sharp: Missing Authorization Check in Quick Creation Command Endpoints
Summary
Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/729 | x_refsource_MISC |
| https://github.com/code16/sharp/commit/aa18a85fd8… | x_refsource_MISC |
| https://github.com/code16/sharp/releases/tag/v9.22.3 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53634",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:17:08.204091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T14:17:22.071Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.22.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. This issue has been patched in version 9.22.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T20:03:33.950Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-vmwx-m75v-qvch"
},
{
"name": "https://github.com/code16/sharp/pull/729",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/729"
},
{
"name": "https://github.com/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/commit/aa18a85fd8fef830988a336cad2278986729d21a"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.22.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.22.3"
}
],
"source": {
"advisory": "GHSA-vmwx-m75v-qvch",
"discovery": "UNKNOWN"
},
"title": "Sharp: Missing Authorization Check in Quick Creation Command Endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53634",
"datePublished": "2026-06-10T20:03:33.950Z",
"dateReserved": "2026-06-09T20:16:59.647Z",
"dateUpdated": "2026-06-11T14:17:22.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33686 (GCVE-0-2026-33686)
Vulnerability from cvelistv5 – Published: 2026-03-26 21:54 – Updated: 2026-03-27 13:59
VLAI
Title
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
Summary
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/715 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T13:59:38.470602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T13:59:50.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file\u0027s extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:54:25.294Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958"
},
{
"name": "https://github.com/code16/sharp/pull/715",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/715"
}
],
"source": {
"advisory": "GHSA-9ffq-6457-8958",
"discovery": "UNKNOWN"
},
"title": "Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33686",
"datePublished": "2026-03-26T21:54:25.294Z",
"dateReserved": "2026-03-23T16:34:59.931Z",
"dateUpdated": "2026-03-27T13:59:50.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33687 (GCVE-0-2026-33687)
Vulnerability from cvelistv5 – Published: 2026-03-26 21:47 – Updated: 2026-03-27 20:28
VLAI
Title
Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
Summary
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. This issue has been addressed in version 9.20.0 by removing the client-controlled validation rules and strictly defining upload rules server-side. As a workaround, ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/714 | x_refsource_MISC |
| https://github.com/code16/sharp/releases/tag/v9.20.0 | x_refsource_MISC |
| https://laravel.com/docs/13.x/filesystem | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T20:28:24.566534Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T20:28:53.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. This issue has been addressed in version 9.20.0 by removing the client-controlled validation rules and strictly defining upload rules server-side. As a workaround, ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:53:26.004Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-fr76-5637-w3g9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-fr76-5637-w3g9"
},
{
"name": "https://github.com/code16/sharp/pull/714",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/714"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.20.0"
},
{
"name": "https://laravel.com/docs/13.x/filesystem",
"tags": [
"x_refsource_MISC"
],
"url": "https://laravel.com/docs/13.x/filesystem"
}
],
"source": {
"advisory": "GHSA-fr76-5637-w3g9",
"discovery": "UNKNOWN"
},
"title": "Sharp has Unrestricted File Upload via Client-Controlled Validation Rules"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33687",
"datePublished": "2026-03-26T21:47:55.573Z",
"dateReserved": "2026-03-23T16:34:59.932Z",
"dateUpdated": "2026-03-27T20:28:53.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-62798 (GCVE-0-2025-62798)
Vulnerability from cvelistv5 – Published: 2025-10-28 20:58 – Updated: 2025-10-29 17:31
VLAI
Title
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax
Summary
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/code16/sharp/security/advisori… | x_refsource_CONFIRM |
| https://github.com/code16/sharp/pull/654 | x_refsource_MISC |
| https://github.com/code16/sharp/releases/tag/v9.11.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-62798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-29T17:31:18.507828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-29T17:31:24.267Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sharp",
"vendor": "code16",
"versions": [
{
"status": "affected",
"version": "\u003c 9.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ \u0026 }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 ."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-28T20:58:21.793Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/code16/sharp/security/advisories/GHSA-9f58-4465-23c7"
},
{
"name": "https://github.com/code16/sharp/pull/654",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/pull/654"
},
{
"name": "https://github.com/code16/sharp/releases/tag/v9.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/code16/sharp/releases/tag/v9.11.1"
}
],
"source": {
"advisory": "GHSA-9f58-4465-23c7",
"discovery": "UNKNOWN"
},
"title": "Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-62798",
"datePublished": "2025-10-28T20:58:21.793Z",
"dateReserved": "2025-10-22T18:55:48.011Z",
"dateUpdated": "2025-10-29T17:31:24.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}