PT-2026-146403
CVE-2026-84974
·
Publicado
2026-11-12
·
Atualizado
2026-11-12
Descrição por
CVSS 3.1
5.4
MédiaMétricasAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Impact
An authenticated attacker can instantiate any class in the PHP application by using the
embed key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.Patches
The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that
embed key is a class extending SharpFormEditorEmbed before any instantiation.Workarounds
No known workarounds.
Explorabilidade
Correção
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾