Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A Stored Cross-Site Scripting (XSS) vulnerability exists in the rich text editor due to improper sanitization of the srcdoc attribute on <iframe elements. While the underlying Symfony HtmlSanitizer correctly HTML-encodes special characters inside the attribute value (e.g., converting <script to <script>), the HTML specification mandates that browsers automatically decode HTML entities inside attribute values before processing them. As a result, any encoded JavaScript inside a srcdoc attribute is evaluated and executed as live HTML/JS in the context of the iframe when the page is rendered. An attacker with permissions to edit an Editor field can inject malicious scripts to target other users viewing the content. Potential impacts include: - Session Hijacking (stealing admin session cookies via document.cookie) - Account Takeover & Privilege Escalation (e.g., a low-privileged editor triggering actions as an Administrator) - Admin panel data theft Patches The vulnerability…
Recommended action: Upgrade to 9.22.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The vulnerability allows an attacker to bypass the HTML sanitizer by using the data-html-content attribute in the content of a SharpEditorFormField. Patches The field must now explicitly configure SharpFormEditorField::RAWHTML in the toolbar to keep this behavior. When using the RAWHTML button, the application using code16/sharp must sanitize manually the content coming from the field. Vulnerability has been patched in version 9.22.5. Workarounds Sanitize every contents of editors manually (e.g. using Symfony/HtmlSanitizer)
Recommended action: Upgrade to 9.22.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retrieve the creation form or submit new records for that entity, as long as it had a Quick Creation Command handler configured. Patches Yes. The fix is included in version 9.22.3. Users should upgrade to that version or later. Workarounds Remove or disable Quick Creation Command handlers (quickCreationCommandHandler()) on any entity list where unauthorized access is a concern, until an upgrade is possible. Resources PR #729
Recommended action: Upgrade to 9.22.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. Impact An authenticated Sharp user with view access to at least one valid Sharp entity instance may be able to download unrelated files from configured Laravel Storage disks by supplying a different disk and path to the generic download endpoint. Depending on the application, exposed files may include exports, backups,…
Recommended action: Upgrade to 9.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. Detail In src/Utils/FileUtil.php, the FileUtil::explodeExtension() function extracts a file's extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a normalizeName() function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the storeAs() function. Impact Exploiting this flaw allows an authenticated attacker to manipulate file paths: - Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp - Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE…
Recommended action: Upgrade to 9.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The code16/sharp Laravel admin panel package contains a vulnerability in its file upload endpoint that allows authenticated users to bypass all file type restrictions. Details The upload endpoint within the ApiFormUploadController accepts a client-controlled validationrule parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending validationrule[]=file, an attacker can completely bypass all MIME type and file extension restrictions. The vulnerable code is located in src/Http/Controllers/Api/ApiFormUploadController.php at line 24. Impact This vulnerability leads to several critical security risks: Attackers can upload arbitrary files, including PHP webshells, to the server. For more details on the package, visit: https://github.com/code16/sharp MIME type and extension validation can be bypassed entirely via client-controlled rules. Review the CWE definition here:…
Recommended action: Upgrade to 9.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. For example, if a field’s value contains {{ Math.random() }}, it will be executed instead of being displayed as text. Impact Attackers who can control content rendered through SharpShowTextField could execute arbitrary JavaScript in the context of an authenticated user’s browser. This could lead to: - Theft of user session tokens. - Unauthorized actions performed on behalf of users. - Injection of malicious content into the admin panel. Patches The issue has been fixed in v9.11.1 of code16/sharp package. Mitigation / Workarounds Sanitize or encode any user-provided data that may include ({{ & }}) before displaying it in a SharpShowTextField.
Recommended action: Upgrade to 9.11.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.
Recommended action: Upgrade to 9.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.