CVE-2026-84974

An authenticated attacker can instantiate any class in the PHP application by using the embed key parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the construct() method of the class is called and all constructor dependencies are resolved. The attacker cannot specify parameter values and cannot call any arbitrary method.

The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. An additional check was added to verify that embed key is a class extending SharpFormEditorEmbed before any instantiation.

No known workarounds.