Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

code16/sharp

8 known vulnerabilities (5 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 5 high, 3 medium
Registry
Packagist

Advisories 8

  • code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

    Affected: fixed in 9.22.5.

  • code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

    Affected: fixed in 9.22.5.

  • Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

    Affected: fixed in 9.22.0.

  • CVE-2026-53634Medium 4.3

    Sharp: Missing Authorization Check in Quick Creation Command Endpoints

    Affected: from 9.0.0, fixed in 9.22.3.

  • Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

    Affected: fixed in 9.20.0.

  • Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

    Affected: fixed in 9.20.0.

  • CVE-2025-62798Medium 5.4

    Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

    Affected: fixed in 9.11.1.

  • CVE-2025-61457Medium 6.1

    code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.

    Affected: fixed in 9.7.0.