Composer code16/sharp has 8 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-33686 | Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil | high | 8.8 | <9.20.0 | 9.20.0 |
| CVE-2026-33687 | Sharp has Unrestricted File Upload via Client-Controlled Validation Rules | high | 8.8 | <9.20.0 | 9.20.0 |
| CVE-2025-61457 | code16 Sharp vulnerable to Cross Site Scripting (XSS) | medium | 6.1 | <9.7.0 | 9.7.0 |
| CVE-2026-44692 | Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint | high | 7.7 | <9.22.0 | 9.22.0 |
| CVE-2026-61825 | code16/sharp has a stored XSS via data-html-content Sanitizer Bypass | high | 8.7 | <9.22.5 | 9.22.5 |
| CVE-2025-62798 | Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax | medium | 5.4 | <9.11.1 | 9.11.1 |
| CVE-2026-53634 | Sharp Missing Authorization Check in Quick Creation Command Endpoints | medium | 4.3 | >=9.0.0 and <9.22.3 | 9.22.3 |
| CVE-2026-61823 | code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute | high | 7.3 | <9.22.5 | 9.22.5 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked