Is CVE-2026-84987 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84987 being exploited in the wild.

How severe is CVE-2026-84987?

Medium severity, with a CVSS score of 5.4, published 12 November 2026.

Which products and versions are affected?

Code16 Sharp = 10.0.0-beta.1 and < 10.0.0-beta.4; code16/sharp (Packagist) < 9.23.0.

How is CVE-2026-84987 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84987?

Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84987: code16/sharp server-side request forgery in autocomplete endpoint

Q: Is there a fix for CVE-2026-84987?

Yes: fixed in 9.23.0, 10.0.0-beta.4. Until then: Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint() to avoid the vulnerable endpoint validation logic. [{"kind":"disclosed","at":"2026-07-17"},{"kind":"advisory","at":"2026-11-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-84987 · Severity: medium · CVSS 5.4 · Published 2026-11-12

Sharp is a Laravel admin framework used to build administrative interfaces for web applications. An authenticated attacker can bypass the endpoint validation in the autocomplete feature by passing the configured endpoint as a substring, allowing them to make requests to unintended server-side routes. This could enable an attacker to access sensitive functionality or data they should not have permission to reach.

Technologies: Code16 Sharp, code16/sharp (Packagist). Vendors: Code16, Packagist.

Quick answers

Is CVE-2026-84987 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84987 being exploited in the wild.
How severe is CVE-2026-84987?: Medium severity, with a CVSS score of 5.4, published 12 November 2026.
Which products and versions are affected?: Code16 Sharp < 9.23.0, >= 10.0.0-beta.1 and < 10.0.0-beta.4; code16/sharp (Packagist) < 9.23.0.
Is there a fix for CVE-2026-84987?: Yes: fixed in 9.23.0, 10.0.0-beta.4. Until then: Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint() to avoid the vulnerable endpoint validation logic.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-07-17"},{"kind":"advisory","at":"2026-11-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84987 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84987?: Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.23.0, 10.0.0-beta.4

Use SharpFormAutocompleteRemoteField::setRemoteCallback() instead of SharpFormAutocompleteRemoteField::setRemoteEndpoint() to avoid the vulnerable endpoint validation logic.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-07-17"},{"kind":"advisory","at":"2026-11-12"}]

Technical details

The vulnerability is a server-side request forgery (SSRF) caused by an unanchored regex that validates autocomplete API endpoints. An authenticated attacker can pass the configured endpoint as a substring in a crafted request to bypass the check and target arbitrary server routes. The fix anchors the regex pattern to prevent substring injection attacks.

Affected products

code16 sharp < 9.23.0, >= 10.0.0-beta.1 and < 10.0.0-beta.4

Identifiers

CVE-2026-84987
GHSA-g6f8-c3x9-jv7f

References

https://api.github.com/users/The4v1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.