Code16 Sharp vulnerabilities

CVE-2023-4863 [HIGH] sharp vulnerability in libwebp dependency CVE-2023-4863 sharp vulnerability in libwebp dependency CVE-2023-4863 ## Overview sharp uses libwebp to decode WebP images and versions prior to the latest 0.32.6 are vulnerable to the high severity https://github.com/advisories/GHSA-j7hp-h8jx-5ppr. ## Who does this affect? Almost anyone processing untrusted input with versions of sharp prior to 0.32.6. ## How to resolve this? ### Using prebuilt binaries provided by sharp? Mos

CVE-2026-33687 [HIGH] CWE-434 CVE-2026-33687: Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 con Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is di

CVE-2026-33686 [HIGH] CWE-22 CVE-2026-33686: Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 hav Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function ext

CVE-2026-44692 [HIGH] CWE-639 CVE-2026-44692: Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sha Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity

CVE-2022-29256 [MEDIUM] CWE-77 sharp vulnerable to Command Injection in post-installation over build environment sharp vulnerable to Command Injection in post-installation over build environment There's a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5. This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their b

CVE-2025-62798 [MEDIUM] CWE-79 CVE-2025-62798: Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Sit Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScr

CVE-2025-61457 [MEDIUM] CWE-79 code16 Sharp vulnerable to Cross Site Scripting (XSS) code16 Sharp vulnerable to Cross Site Scripting (XSS) code16 Sharp v9.6.6 is vulnerable to Cross Site Scripting (XSS) src/Form/Fields/SharpFormUploadField.php.

CVE-2026-53634 [MEDIUM] CWE-862 CVE-2026-53634: Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quick Creation Command feature did not enforce any authorization check. An authenticated Sharp user without create permission on a given entity could bypass the authorization layer and either retr